<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="32">
<package pkgid="a3926c8878ef22117089cdd817e84b7d8631d69f7e9a141fff69f25abfd2a1ee" name="kanidm" arch="aarch64">
  <version epoch="0" ver="1.10.4" rel="1.el10"/>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.0-1" date="1777809600">- Initial package based on SUSE and J.B. Crawford Fedora packaging

- Important 1.10.0 Changes :
. OpenSSL is no longer required as a dependency. All cryptographic paths have
  been replaced by RustCrypto or Rustls using aws-lc-rs.
. Kanidm-unixd now supports bind mounts as an alternative to symlinks for home
  mapping.
. Account recovery can be enabled as a feature allowing a user to prove knowledge
  of their own email, and then have a credential reset email sent to them.
. Administrators can also trigger account recovery emails to be sent to users.</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.2-1" date="1777809601">- Update to 1.10.2
. Security - Critical: Any authenticated user is able to modify the attributes
  of any entry they have read permissions over. This is due to a logic flaw in
  modification access control application. Since all authenticated users are
  able to read all groups and group members, any authenticated user is able to
  add themself to any privileged group resulting in complete compromise of the
  servers security boundaries.
. Revert client_id header in JWTs used in OAuth2/OIDC - this is due to incorrect
  behaviour of some OAuth2 clients rejecting content of the protected header.
. Disable OIDC prompt=login - a number of issues were identified in this flow
  that are unable to be trivially fixed until a future release.
. Remove debug-symbols from release builds to reduce container image sizes.

- Changelog 1.10.1
. Resolve an incorrect javascript encoding of some fields that prevents new
  Webauthn enrolments from completing
. Correct incorrect text in TOTP CLI credential updates</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.4-1" date="1783944000">- Update to 1.10.4
. Security - High: LDAP BER Parsing did not contain a bound on their parsing
  depth allowing stack exhaustion to occur leading to Denial of Service by an
  unauthenticated user (reported by @kah-ja)

- Changelog 1.10.3
. Resolve an incorrect internal query that can prevent upgrades from 1.9 to
  1.10 in rare circumstances
. Resolve a unixd resolver deadlock that can occur during rare data conflict
  conditions</changelog>
</package>
<package pkgid="b1a29538c1f562f52657d60609ae84de7744054ab0c85041213e0ff4fd130a19" name="kanidm" arch="aarch64">
  <version epoch="0" ver="1.10.4" rel="1.el10"/>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.0-1" date="1777809600">- Initial package based on SUSE and J.B. Crawford Fedora packaging

- Important 1.10.0 Changes :
. OpenSSL is no longer required as a dependency. All cryptographic paths have
  been replaced by RustCrypto or Rustls using aws-lc-rs.
. Kanidm-unixd now supports bind mounts as an alternative to symlinks for home
  mapping.
. Account recovery can be enabled as a feature allowing a user to prove knowledge
  of their own email, and then have a credential reset email sent to them.
. Administrators can also trigger account recovery emails to be sent to users.</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.2-1" date="1777809601">- Update to 1.10.2
. Security - Critical: Any authenticated user is able to modify the attributes
  of any entry they have read permissions over. This is due to a logic flaw in
  modification access control application. Since all authenticated users are
  able to read all groups and group members, any authenticated user is able to
  add themself to any privileged group resulting in complete compromise of the
  servers security boundaries.
. Revert client_id header in JWTs used in OAuth2/OIDC - this is due to incorrect
  behaviour of some OAuth2 clients rejecting content of the protected header.
. Disable OIDC prompt=login - a number of issues were identified in this flow
  that are unable to be trivially fixed until a future release.
. Remove debug-symbols from release builds to reduce container image sizes.

- Changelog 1.10.1
. Resolve an incorrect javascript encoding of some fields that prevents new
  Webauthn enrolments from completing
. Correct incorrect text in TOTP CLI credential updates</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.4-1" date="1783944000">- Update to 1.10.4
. Security - High: LDAP BER Parsing did not contain a bound on their parsing
  depth allowing stack exhaustion to occur leading to Denial of Service by an
  unauthenticated user (reported by @kah-ja)

- Changelog 1.10.3
. Resolve an incorrect internal query that can prevent upgrades from 1.9 to
  1.10 in rare circumstances
. Resolve a unixd resolver deadlock that can occur during rare data conflict
  conditions</changelog>
</package>
<package pkgid="e97eaf8ec73c686641eb3ac5041166592db82706902035a4e41f6674209f0c86" name="kanidm" arch="src">
  <version epoch="0" ver="1.10.4" rel="1.el10"/>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.0-1" date="1777809600">- Initial package based on SUSE and J.B. Crawford Fedora packaging

- Important 1.10.0 Changes :
. OpenSSL is no longer required as a dependency. All cryptographic paths have
  been replaced by RustCrypto or Rustls using aws-lc-rs.
. Kanidm-unixd now supports bind mounts as an alternative to symlinks for home
  mapping.
. Account recovery can be enabled as a feature allowing a user to prove knowledge
  of their own email, and then have a credential reset email sent to them.
. Administrators can also trigger account recovery emails to be sent to users.</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.2-1" date="1777809601">- Update to 1.10.2
. Security - Critical: Any authenticated user is able to modify the attributes
  of any entry they have read permissions over. This is due to a logic flaw in
  modification access control application. Since all authenticated users are
  able to read all groups and group members, any authenticated user is able to
  add themself to any privileged group resulting in complete compromise of the
  servers security boundaries.
. Revert client_id header in JWTs used in OAuth2/OIDC - this is due to incorrect
  behaviour of some OAuth2 clients rejecting content of the protected header.
. Disable OIDC prompt=login - a number of issues were identified in this flow
  that are unable to be trivially fixed until a future release.
. Remove debug-symbols from release builds to reduce container image sizes.

- Changelog 1.10.1
. Resolve an incorrect javascript encoding of some fields that prevents new
  Webauthn enrolments from completing
. Correct incorrect text in TOTP CLI credential updates</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.4-1" date="1783944000">- Update to 1.10.4
. Security - High: LDAP BER Parsing did not contain a bound on their parsing
  depth allowing stack exhaustion to occur leading to Denial of Service by an
  unauthenticated user (reported by @kah-ja)

- Changelog 1.10.3
. Resolve an incorrect internal query that can prevent upgrades from 1.9 to
  1.10 in rare circumstances
. Resolve a unixd resolver deadlock that can occur during rare data conflict
  conditions</changelog>
</package>
<package pkgid="ce9cdf3a9de49116d84b66ca3102c2be24bda6fdd3e1a4c7b41c42412fa190e9" name="kanidm" arch="src">
  <version epoch="0" ver="1.10.4" rel="1.el10"/>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.0-1" date="1777809600">- Initial package based on SUSE and J.B. Crawford Fedora packaging

- Important 1.10.0 Changes :
. OpenSSL is no longer required as a dependency. All cryptographic paths have
  been replaced by RustCrypto or Rustls using aws-lc-rs.
. Kanidm-unixd now supports bind mounts as an alternative to symlinks for home
  mapping.
. Account recovery can be enabled as a feature allowing a user to prove knowledge
  of their own email, and then have a credential reset email sent to them.
. Administrators can also trigger account recovery emails to be sent to users.</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.2-1" date="1777809601">- Update to 1.10.2
. Security - Critical: Any authenticated user is able to modify the attributes
  of any entry they have read permissions over. This is due to a logic flaw in
  modification access control application. Since all authenticated users are
  able to read all groups and group members, any authenticated user is able to
  add themself to any privileged group resulting in complete compromise of the
  servers security boundaries.
. Revert client_id header in JWTs used in OAuth2/OIDC - this is due to incorrect
  behaviour of some OAuth2 clients rejecting content of the protected header.
. Disable OIDC prompt=login - a number of issues were identified in this flow
  that are unable to be trivially fixed until a future release.
. Remove debug-symbols from release builds to reduce container image sizes.

- Changelog 1.10.1
. Resolve an incorrect javascript encoding of some fields that prevents new
  Webauthn enrolments from completing
. Correct incorrect text in TOTP CLI credential updates</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.4-1" date="1783944000">- Update to 1.10.4
. Security - High: LDAP BER Parsing did not contain a bound on their parsing
  depth allowing stack exhaustion to occur leading to Denial of Service by an
  unauthenticated user (reported by @kah-ja)

- Changelog 1.10.3
. Resolve an incorrect internal query that can prevent upgrades from 1.9 to
  1.10 in rare circumstances
. Resolve a unixd resolver deadlock that can occur during rare data conflict
  conditions</changelog>
</package>
<package pkgid="3b6821357fcba5cbf01ed0efeecdc91fdacc25a7215169ea3811ec0bd3ed47bf" name="kanidm-clients" arch="aarch64">
  <version epoch="0" ver="1.10.4" rel="1.el10"/>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.0-1" date="1777809600">- Initial package based on SUSE and J.B. Crawford Fedora packaging

- Important 1.10.0 Changes :
. OpenSSL is no longer required as a dependency. All cryptographic paths have
  been replaced by RustCrypto or Rustls using aws-lc-rs.
. Kanidm-unixd now supports bind mounts as an alternative to symlinks for home
  mapping.
. Account recovery can be enabled as a feature allowing a user to prove knowledge
  of their own email, and then have a credential reset email sent to them.
. Administrators can also trigger account recovery emails to be sent to users.</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.2-1" date="1777809601">- Update to 1.10.2
. Security - Critical: Any authenticated user is able to modify the attributes
  of any entry they have read permissions over. This is due to a logic flaw in
  modification access control application. Since all authenticated users are
  able to read all groups and group members, any authenticated user is able to
  add themself to any privileged group resulting in complete compromise of the
  servers security boundaries.
. Revert client_id header in JWTs used in OAuth2/OIDC - this is due to incorrect
  behaviour of some OAuth2 clients rejecting content of the protected header.
. Disable OIDC prompt=login - a number of issues were identified in this flow
  that are unable to be trivially fixed until a future release.
. Remove debug-symbols from release builds to reduce container image sizes.

- Changelog 1.10.1
. Resolve an incorrect javascript encoding of some fields that prevents new
  Webauthn enrolments from completing
. Correct incorrect text in TOTP CLI credential updates</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.4-1" date="1783944000">- Update to 1.10.4
. Security - High: LDAP BER Parsing did not contain a bound on their parsing
  depth allowing stack exhaustion to occur leading to Denial of Service by an
  unauthenticated user (reported by @kah-ja)

- Changelog 1.10.3
. Resolve an incorrect internal query that can prevent upgrades from 1.9 to
  1.10 in rare circumstances
. Resolve a unixd resolver deadlock that can occur during rare data conflict
  conditions</changelog>
</package>
<package pkgid="4bf00f7c7467446027e1ef09136ca39e9596ce1ad1c587bb7d95c24e23fa0679" name="kanidm-clients" arch="aarch64">
  <version epoch="0" ver="1.10.4" rel="1.el10"/>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.0-1" date="1777809600">- Initial package based on SUSE and J.B. Crawford Fedora packaging

- Important 1.10.0 Changes :
. OpenSSL is no longer required as a dependency. All cryptographic paths have
  been replaced by RustCrypto or Rustls using aws-lc-rs.
. Kanidm-unixd now supports bind mounts as an alternative to symlinks for home
  mapping.
. Account recovery can be enabled as a feature allowing a user to prove knowledge
  of their own email, and then have a credential reset email sent to them.
. Administrators can also trigger account recovery emails to be sent to users.</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.2-1" date="1777809601">- Update to 1.10.2
. Security - Critical: Any authenticated user is able to modify the attributes
  of any entry they have read permissions over. This is due to a logic flaw in
  modification access control application. Since all authenticated users are
  able to read all groups and group members, any authenticated user is able to
  add themself to any privileged group resulting in complete compromise of the
  servers security boundaries.
. Revert client_id header in JWTs used in OAuth2/OIDC - this is due to incorrect
  behaviour of some OAuth2 clients rejecting content of the protected header.
. Disable OIDC prompt=login - a number of issues were identified in this flow
  that are unable to be trivially fixed until a future release.
. Remove debug-symbols from release builds to reduce container image sizes.

- Changelog 1.10.1
. Resolve an incorrect javascript encoding of some fields that prevents new
  Webauthn enrolments from completing
. Correct incorrect text in TOTP CLI credential updates</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.4-1" date="1783944000">- Update to 1.10.4
. Security - High: LDAP BER Parsing did not contain a bound on their parsing
  depth allowing stack exhaustion to occur leading to Denial of Service by an
  unauthenticated user (reported by @kah-ja)

- Changelog 1.10.3
. Resolve an incorrect internal query that can prevent upgrades from 1.9 to
  1.10 in rare circumstances
. Resolve a unixd resolver deadlock that can occur during rare data conflict
  conditions</changelog>
</package>
<package pkgid="120f3a9c79eb71eb372b175b33961128d764c3ac15358ca05941edd67d2b68d8" name="kanidm-clients-debuginfo" arch="aarch64">
  <version epoch="0" ver="1.10.4" rel="1.el10"/>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.0-1" date="1777809600">- Initial package based on SUSE and J.B. Crawford Fedora packaging

- Important 1.10.0 Changes :
. OpenSSL is no longer required as a dependency. All cryptographic paths have
  been replaced by RustCrypto or Rustls using aws-lc-rs.
. Kanidm-unixd now supports bind mounts as an alternative to symlinks for home
  mapping.
. Account recovery can be enabled as a feature allowing a user to prove knowledge
  of their own email, and then have a credential reset email sent to them.
. Administrators can also trigger account recovery emails to be sent to users.</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.2-1" date="1777809601">- Update to 1.10.2
. Security - Critical: Any authenticated user is able to modify the attributes
  of any entry they have read permissions over. This is due to a logic flaw in
  modification access control application. Since all authenticated users are
  able to read all groups and group members, any authenticated user is able to
  add themself to any privileged group resulting in complete compromise of the
  servers security boundaries.
. Revert client_id header in JWTs used in OAuth2/OIDC - this is due to incorrect
  behaviour of some OAuth2 clients rejecting content of the protected header.
. Disable OIDC prompt=login - a number of issues were identified in this flow
  that are unable to be trivially fixed until a future release.
. Remove debug-symbols from release builds to reduce container image sizes.

- Changelog 1.10.1
. Resolve an incorrect javascript encoding of some fields that prevents new
  Webauthn enrolments from completing
. Correct incorrect text in TOTP CLI credential updates</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.4-1" date="1783944000">- Update to 1.10.4
. Security - High: LDAP BER Parsing did not contain a bound on their parsing
  depth allowing stack exhaustion to occur leading to Denial of Service by an
  unauthenticated user (reported by @kah-ja)

- Changelog 1.10.3
. Resolve an incorrect internal query that can prevent upgrades from 1.9 to
  1.10 in rare circumstances
. Resolve a unixd resolver deadlock that can occur during rare data conflict
  conditions</changelog>
</package>
<package pkgid="d5beeeb9e2a32e1385d140bce622dd26480d962610a16a1b5a354a9b64e292cd" name="kanidm-clients-debuginfo" arch="aarch64">
  <version epoch="0" ver="1.10.4" rel="1.el10"/>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.0-1" date="1777809600">- Initial package based on SUSE and J.B. Crawford Fedora packaging

- Important 1.10.0 Changes :
. OpenSSL is no longer required as a dependency. All cryptographic paths have
  been replaced by RustCrypto or Rustls using aws-lc-rs.
. Kanidm-unixd now supports bind mounts as an alternative to symlinks for home
  mapping.
. Account recovery can be enabled as a feature allowing a user to prove knowledge
  of their own email, and then have a credential reset email sent to them.
. Administrators can also trigger account recovery emails to be sent to users.</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.2-1" date="1777809601">- Update to 1.10.2
. Security - Critical: Any authenticated user is able to modify the attributes
  of any entry they have read permissions over. This is due to a logic flaw in
  modification access control application. Since all authenticated users are
  able to read all groups and group members, any authenticated user is able to
  add themself to any privileged group resulting in complete compromise of the
  servers security boundaries.
. Revert client_id header in JWTs used in OAuth2/OIDC - this is due to incorrect
  behaviour of some OAuth2 clients rejecting content of the protected header.
. Disable OIDC prompt=login - a number of issues were identified in this flow
  that are unable to be trivially fixed until a future release.
. Remove debug-symbols from release builds to reduce container image sizes.

- Changelog 1.10.1
. Resolve an incorrect javascript encoding of some fields that prevents new
  Webauthn enrolments from completing
. Correct incorrect text in TOTP CLI credential updates</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.4-1" date="1783944000">- Update to 1.10.4
. Security - High: LDAP BER Parsing did not contain a bound on their parsing
  depth allowing stack exhaustion to occur leading to Denial of Service by an
  unauthenticated user (reported by @kah-ja)

- Changelog 1.10.3
. Resolve an incorrect internal query that can prevent upgrades from 1.9 to
  1.10 in rare circumstances
. Resolve a unixd resolver deadlock that can occur during rare data conflict
  conditions</changelog>
</package>
<package pkgid="a524a3cf5a1674713bd646ed5708df26d6b82481268119a618a57b155fd13dbd" name="kanidm-debuginfo" arch="aarch64">
  <version epoch="0" ver="1.10.4" rel="1.el10"/>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.0-1" date="1777809600">- Initial package based on SUSE and J.B. Crawford Fedora packaging

- Important 1.10.0 Changes :
. OpenSSL is no longer required as a dependency. All cryptographic paths have
  been replaced by RustCrypto or Rustls using aws-lc-rs.
. Kanidm-unixd now supports bind mounts as an alternative to symlinks for home
  mapping.
. Account recovery can be enabled as a feature allowing a user to prove knowledge
  of their own email, and then have a credential reset email sent to them.
. Administrators can also trigger account recovery emails to be sent to users.</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.2-1" date="1777809601">- Update to 1.10.2
. Security - Critical: Any authenticated user is able to modify the attributes
  of any entry they have read permissions over. This is due to a logic flaw in
  modification access control application. Since all authenticated users are
  able to read all groups and group members, any authenticated user is able to
  add themself to any privileged group resulting in complete compromise of the
  servers security boundaries.
. Revert client_id header in JWTs used in OAuth2/OIDC - this is due to incorrect
  behaviour of some OAuth2 clients rejecting content of the protected header.
. Disable OIDC prompt=login - a number of issues were identified in this flow
  that are unable to be trivially fixed until a future release.
. Remove debug-symbols from release builds to reduce container image sizes.

- Changelog 1.10.1
. Resolve an incorrect javascript encoding of some fields that prevents new
  Webauthn enrolments from completing
. Correct incorrect text in TOTP CLI credential updates</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.4-1" date="1783944000">- Update to 1.10.4
. Security - High: LDAP BER Parsing did not contain a bound on their parsing
  depth allowing stack exhaustion to occur leading to Denial of Service by an
  unauthenticated user (reported by @kah-ja)

- Changelog 1.10.3
. Resolve an incorrect internal query that can prevent upgrades from 1.9 to
  1.10 in rare circumstances
. Resolve a unixd resolver deadlock that can occur during rare data conflict
  conditions</changelog>
</package>
<package pkgid="963ea9a3ee9fcbed690b6ea02b66e6bffae9b6b53edb11018b2303cebb592412" name="kanidm-debuginfo" arch="aarch64">
  <version epoch="0" ver="1.10.4" rel="1.el10"/>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.0-1" date="1777809600">- Initial package based on SUSE and J.B. Crawford Fedora packaging

- Important 1.10.0 Changes :
. OpenSSL is no longer required as a dependency. All cryptographic paths have
  been replaced by RustCrypto or Rustls using aws-lc-rs.
. Kanidm-unixd now supports bind mounts as an alternative to symlinks for home
  mapping.
. Account recovery can be enabled as a feature allowing a user to prove knowledge
  of their own email, and then have a credential reset email sent to them.
. Administrators can also trigger account recovery emails to be sent to users.</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.2-1" date="1777809601">- Update to 1.10.2
. Security - Critical: Any authenticated user is able to modify the attributes
  of any entry they have read permissions over. This is due to a logic flaw in
  modification access control application. Since all authenticated users are
  able to read all groups and group members, any authenticated user is able to
  add themself to any privileged group resulting in complete compromise of the
  servers security boundaries.
. Revert client_id header in JWTs used in OAuth2/OIDC - this is due to incorrect
  behaviour of some OAuth2 clients rejecting content of the protected header.
. Disable OIDC prompt=login - a number of issues were identified in this flow
  that are unable to be trivially fixed until a future release.
. Remove debug-symbols from release builds to reduce container image sizes.

- Changelog 1.10.1
. Resolve an incorrect javascript encoding of some fields that prevents new
  Webauthn enrolments from completing
. Correct incorrect text in TOTP CLI credential updates</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.4-1" date="1783944000">- Update to 1.10.4
. Security - High: LDAP BER Parsing did not contain a bound on their parsing
  depth allowing stack exhaustion to occur leading to Denial of Service by an
  unauthenticated user (reported by @kah-ja)

- Changelog 1.10.3
. Resolve an incorrect internal query that can prevent upgrades from 1.9 to
  1.10 in rare circumstances
. Resolve a unixd resolver deadlock that can occur during rare data conflict
  conditions</changelog>
</package>
<package pkgid="abfd891c3586ef120c3a1205aa7a26d25382141d655e61c5bc4af39aefe94cb0" name="kanidm-debugsource" arch="aarch64">
  <version epoch="0" ver="1.10.4" rel="1.el10"/>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.0-1" date="1777809600">- Initial package based on SUSE and J.B. Crawford Fedora packaging

- Important 1.10.0 Changes :
. OpenSSL is no longer required as a dependency. All cryptographic paths have
  been replaced by RustCrypto or Rustls using aws-lc-rs.
. Kanidm-unixd now supports bind mounts as an alternative to symlinks for home
  mapping.
. Account recovery can be enabled as a feature allowing a user to prove knowledge
  of their own email, and then have a credential reset email sent to them.
. Administrators can also trigger account recovery emails to be sent to users.</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.2-1" date="1777809601">- Update to 1.10.2
. Security - Critical: Any authenticated user is able to modify the attributes
  of any entry they have read permissions over. This is due to a logic flaw in
  modification access control application. Since all authenticated users are
  able to read all groups and group members, any authenticated user is able to
  add themself to any privileged group resulting in complete compromise of the
  servers security boundaries.
. Revert client_id header in JWTs used in OAuth2/OIDC - this is due to incorrect
  behaviour of some OAuth2 clients rejecting content of the protected header.
. Disable OIDC prompt=login - a number of issues were identified in this flow
  that are unable to be trivially fixed until a future release.
. Remove debug-symbols from release builds to reduce container image sizes.

- Changelog 1.10.1
. Resolve an incorrect javascript encoding of some fields that prevents new
  Webauthn enrolments from completing
. Correct incorrect text in TOTP CLI credential updates</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.4-1" date="1783944000">- Update to 1.10.4
. Security - High: LDAP BER Parsing did not contain a bound on their parsing
  depth allowing stack exhaustion to occur leading to Denial of Service by an
  unauthenticated user (reported by @kah-ja)

- Changelog 1.10.3
. Resolve an incorrect internal query that can prevent upgrades from 1.9 to
  1.10 in rare circumstances
. Resolve a unixd resolver deadlock that can occur during rare data conflict
  conditions</changelog>
</package>
<package pkgid="1643d0b26600a3d282c8d34b4341ef9026128abfc28681956391c6b1f03a9366" name="kanidm-debugsource" arch="aarch64">
  <version epoch="0" ver="1.10.4" rel="1.el10"/>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.0-1" date="1777809600">- Initial package based on SUSE and J.B. Crawford Fedora packaging

- Important 1.10.0 Changes :
. OpenSSL is no longer required as a dependency. All cryptographic paths have
  been replaced by RustCrypto or Rustls using aws-lc-rs.
. Kanidm-unixd now supports bind mounts as an alternative to symlinks for home
  mapping.
. Account recovery can be enabled as a feature allowing a user to prove knowledge
  of their own email, and then have a credential reset email sent to them.
. Administrators can also trigger account recovery emails to be sent to users.</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.2-1" date="1777809601">- Update to 1.10.2
. Security - Critical: Any authenticated user is able to modify the attributes
  of any entry they have read permissions over. This is due to a logic flaw in
  modification access control application. Since all authenticated users are
  able to read all groups and group members, any authenticated user is able to
  add themself to any privileged group resulting in complete compromise of the
  servers security boundaries.
. Revert client_id header in JWTs used in OAuth2/OIDC - this is due to incorrect
  behaviour of some OAuth2 clients rejecting content of the protected header.
. Disable OIDC prompt=login - a number of issues were identified in this flow
  that are unable to be trivially fixed until a future release.
. Remove debug-symbols from release builds to reduce container image sizes.

- Changelog 1.10.1
. Resolve an incorrect javascript encoding of some fields that prevents new
  Webauthn enrolments from completing
. Correct incorrect text in TOTP CLI credential updates</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.4-1" date="1783944000">- Update to 1.10.4
. Security - High: LDAP BER Parsing did not contain a bound on their parsing
  depth allowing stack exhaustion to occur leading to Denial of Service by an
  unauthenticated user (reported by @kah-ja)

- Changelog 1.10.3
. Resolve an incorrect internal query that can prevent upgrades from 1.9 to
  1.10 in rare circumstances
. Resolve a unixd resolver deadlock that can occur during rare data conflict
  conditions</changelog>
</package>
<package pkgid="062629ad4ba0f156c5540bcd19e6ddb84ddc298125568313363e0947f45440c5" name="kanidm-docs" arch="aarch64">
  <version epoch="0" ver="1.10.4" rel="1.el10"/>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.0-1" date="1777809600">- Initial package based on SUSE and J.B. Crawford Fedora packaging

- Important 1.10.0 Changes :
. OpenSSL is no longer required as a dependency. All cryptographic paths have
  been replaced by RustCrypto or Rustls using aws-lc-rs.
. Kanidm-unixd now supports bind mounts as an alternative to symlinks for home
  mapping.
. Account recovery can be enabled as a feature allowing a user to prove knowledge
  of their own email, and then have a credential reset email sent to them.
. Administrators can also trigger account recovery emails to be sent to users.</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.2-1" date="1777809601">- Update to 1.10.2
. Security - Critical: Any authenticated user is able to modify the attributes
  of any entry they have read permissions over. This is due to a logic flaw in
  modification access control application. Since all authenticated users are
  able to read all groups and group members, any authenticated user is able to
  add themself to any privileged group resulting in complete compromise of the
  servers security boundaries.
. Revert client_id header in JWTs used in OAuth2/OIDC - this is due to incorrect
  behaviour of some OAuth2 clients rejecting content of the protected header.
. Disable OIDC prompt=login - a number of issues were identified in this flow
  that are unable to be trivially fixed until a future release.
. Remove debug-symbols from release builds to reduce container image sizes.

- Changelog 1.10.1
. Resolve an incorrect javascript encoding of some fields that prevents new
  Webauthn enrolments from completing
. Correct incorrect text in TOTP CLI credential updates</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.4-1" date="1783944000">- Update to 1.10.4
. Security - High: LDAP BER Parsing did not contain a bound on their parsing
  depth allowing stack exhaustion to occur leading to Denial of Service by an
  unauthenticated user (reported by @kah-ja)

- Changelog 1.10.3
. Resolve an incorrect internal query that can prevent upgrades from 1.9 to
  1.10 in rare circumstances
. Resolve a unixd resolver deadlock that can occur during rare data conflict
  conditions</changelog>
</package>
<package pkgid="d39152a40614fa8bba0d8c7866d6a680f8209049c168b411709658d58ec6d00a" name="kanidm-docs" arch="aarch64">
  <version epoch="0" ver="1.10.4" rel="1.el10"/>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.0-1" date="1777809600">- Initial package based on SUSE and J.B. Crawford Fedora packaging

- Important 1.10.0 Changes :
. OpenSSL is no longer required as a dependency. All cryptographic paths have
  been replaced by RustCrypto or Rustls using aws-lc-rs.
. Kanidm-unixd now supports bind mounts as an alternative to symlinks for home
  mapping.
. Account recovery can be enabled as a feature allowing a user to prove knowledge
  of their own email, and then have a credential reset email sent to them.
. Administrators can also trigger account recovery emails to be sent to users.</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.2-1" date="1777809601">- Update to 1.10.2
. Security - Critical: Any authenticated user is able to modify the attributes
  of any entry they have read permissions over. This is due to a logic flaw in
  modification access control application. Since all authenticated users are
  able to read all groups and group members, any authenticated user is able to
  add themself to any privileged group resulting in complete compromise of the
  servers security boundaries.
. Revert client_id header in JWTs used in OAuth2/OIDC - this is due to incorrect
  behaviour of some OAuth2 clients rejecting content of the protected header.
. Disable OIDC prompt=login - a number of issues were identified in this flow
  that are unable to be trivially fixed until a future release.
. Remove debug-symbols from release builds to reduce container image sizes.

- Changelog 1.10.1
. Resolve an incorrect javascript encoding of some fields that prevents new
  Webauthn enrolments from completing
. Correct incorrect text in TOTP CLI credential updates</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.4-1" date="1783944000">- Update to 1.10.4
. Security - High: LDAP BER Parsing did not contain a bound on their parsing
  depth allowing stack exhaustion to occur leading to Denial of Service by an
  unauthenticated user (reported by @kah-ja)

- Changelog 1.10.3
. Resolve an incorrect internal query that can prevent upgrades from 1.9 to
  1.10 in rare circumstances
. Resolve a unixd resolver deadlock that can occur during rare data conflict
  conditions</changelog>
</package>
<package pkgid="e2eca04519c9d243d38bb26abaccb8322288e82501d9e8ff1bb3ce10280def48" name="kanidm-server" arch="aarch64">
  <version epoch="0" ver="1.10.4" rel="1.el10"/>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.0-1" date="1777809600">- Initial package based on SUSE and J.B. Crawford Fedora packaging

- Important 1.10.0 Changes :
. OpenSSL is no longer required as a dependency. All cryptographic paths have
  been replaced by RustCrypto or Rustls using aws-lc-rs.
. Kanidm-unixd now supports bind mounts as an alternative to symlinks for home
  mapping.
. Account recovery can be enabled as a feature allowing a user to prove knowledge
  of their own email, and then have a credential reset email sent to them.
. Administrators can also trigger account recovery emails to be sent to users.</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.2-1" date="1777809601">- Update to 1.10.2
. Security - Critical: Any authenticated user is able to modify the attributes
  of any entry they have read permissions over. This is due to a logic flaw in
  modification access control application. Since all authenticated users are
  able to read all groups and group members, any authenticated user is able to
  add themself to any privileged group resulting in complete compromise of the
  servers security boundaries.
. Revert client_id header in JWTs used in OAuth2/OIDC - this is due to incorrect
  behaviour of some OAuth2 clients rejecting content of the protected header.
. Disable OIDC prompt=login - a number of issues were identified in this flow
  that are unable to be trivially fixed until a future release.
. Remove debug-symbols from release builds to reduce container image sizes.

- Changelog 1.10.1
. Resolve an incorrect javascript encoding of some fields that prevents new
  Webauthn enrolments from completing
. Correct incorrect text in TOTP CLI credential updates</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.4-1" date="1783944000">- Update to 1.10.4
. Security - High: LDAP BER Parsing did not contain a bound on their parsing
  depth allowing stack exhaustion to occur leading to Denial of Service by an
  unauthenticated user (reported by @kah-ja)

- Changelog 1.10.3
. Resolve an incorrect internal query that can prevent upgrades from 1.9 to
  1.10 in rare circumstances
. Resolve a unixd resolver deadlock that can occur during rare data conflict
  conditions</changelog>
</package>
<package pkgid="1d29fe155af2d08bfa5d75d1c1b94603dfb3ff0b53d3c8f75a4cf4bc5b41f2d4" name="kanidm-server" arch="aarch64">
  <version epoch="0" ver="1.10.4" rel="1.el10"/>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.0-1" date="1777809600">- Initial package based on SUSE and J.B. Crawford Fedora packaging

- Important 1.10.0 Changes :
. OpenSSL is no longer required as a dependency. All cryptographic paths have
  been replaced by RustCrypto or Rustls using aws-lc-rs.
. Kanidm-unixd now supports bind mounts as an alternative to symlinks for home
  mapping.
. Account recovery can be enabled as a feature allowing a user to prove knowledge
  of their own email, and then have a credential reset email sent to them.
. Administrators can also trigger account recovery emails to be sent to users.</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.2-1" date="1777809601">- Update to 1.10.2
. Security - Critical: Any authenticated user is able to modify the attributes
  of any entry they have read permissions over. This is due to a logic flaw in
  modification access control application. Since all authenticated users are
  able to read all groups and group members, any authenticated user is able to
  add themself to any privileged group resulting in complete compromise of the
  servers security boundaries.
. Revert client_id header in JWTs used in OAuth2/OIDC - this is due to incorrect
  behaviour of some OAuth2 clients rejecting content of the protected header.
. Disable OIDC prompt=login - a number of issues were identified in this flow
  that are unable to be trivially fixed until a future release.
. Remove debug-symbols from release builds to reduce container image sizes.

- Changelog 1.10.1
. Resolve an incorrect javascript encoding of some fields that prevents new
  Webauthn enrolments from completing
. Correct incorrect text in TOTP CLI credential updates</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.4-1" date="1783944000">- Update to 1.10.4
. Security - High: LDAP BER Parsing did not contain a bound on their parsing
  depth allowing stack exhaustion to occur leading to Denial of Service by an
  unauthenticated user (reported by @kah-ja)

- Changelog 1.10.3
. Resolve an incorrect internal query that can prevent upgrades from 1.9 to
  1.10 in rare circumstances
. Resolve a unixd resolver deadlock that can occur during rare data conflict
  conditions</changelog>
</package>
<package pkgid="189013ad2b9bf90c39c10601e2cc3336c13008ed9ed9fb1317e512e17feac109" name="kanidm-server-debuginfo" arch="aarch64">
  <version epoch="0" ver="1.10.4" rel="1.el10"/>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.0-1" date="1777809600">- Initial package based on SUSE and J.B. Crawford Fedora packaging

- Important 1.10.0 Changes :
. OpenSSL is no longer required as a dependency. All cryptographic paths have
  been replaced by RustCrypto or Rustls using aws-lc-rs.
. Kanidm-unixd now supports bind mounts as an alternative to symlinks for home
  mapping.
. Account recovery can be enabled as a feature allowing a user to prove knowledge
  of their own email, and then have a credential reset email sent to them.
. Administrators can also trigger account recovery emails to be sent to users.</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.2-1" date="1777809601">- Update to 1.10.2
. Security - Critical: Any authenticated user is able to modify the attributes
  of any entry they have read permissions over. This is due to a logic flaw in
  modification access control application. Since all authenticated users are
  able to read all groups and group members, any authenticated user is able to
  add themself to any privileged group resulting in complete compromise of the
  servers security boundaries.
. Revert client_id header in JWTs used in OAuth2/OIDC - this is due to incorrect
  behaviour of some OAuth2 clients rejecting content of the protected header.
. Disable OIDC prompt=login - a number of issues were identified in this flow
  that are unable to be trivially fixed until a future release.
. Remove debug-symbols from release builds to reduce container image sizes.

- Changelog 1.10.1
. Resolve an incorrect javascript encoding of some fields that prevents new
  Webauthn enrolments from completing
. Correct incorrect text in TOTP CLI credential updates</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.4-1" date="1783944000">- Update to 1.10.4
. Security - High: LDAP BER Parsing did not contain a bound on their parsing
  depth allowing stack exhaustion to occur leading to Denial of Service by an
  unauthenticated user (reported by @kah-ja)

- Changelog 1.10.3
. Resolve an incorrect internal query that can prevent upgrades from 1.9 to
  1.10 in rare circumstances
. Resolve a unixd resolver deadlock that can occur during rare data conflict
  conditions</changelog>
</package>
<package pkgid="6718488e28edff0d09c67764b1a969467fab86061b5560c15360246a61051e1d" name="kanidm-server-debuginfo" arch="aarch64">
  <version epoch="0" ver="1.10.4" rel="1.el10"/>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.0-1" date="1777809600">- Initial package based on SUSE and J.B. Crawford Fedora packaging

- Important 1.10.0 Changes :
. OpenSSL is no longer required as a dependency. All cryptographic paths have
  been replaced by RustCrypto or Rustls using aws-lc-rs.
. Kanidm-unixd now supports bind mounts as an alternative to symlinks for home
  mapping.
. Account recovery can be enabled as a feature allowing a user to prove knowledge
  of their own email, and then have a credential reset email sent to them.
. Administrators can also trigger account recovery emails to be sent to users.</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.2-1" date="1777809601">- Update to 1.10.2
. Security - Critical: Any authenticated user is able to modify the attributes
  of any entry they have read permissions over. This is due to a logic flaw in
  modification access control application. Since all authenticated users are
  able to read all groups and group members, any authenticated user is able to
  add themself to any privileged group resulting in complete compromise of the
  servers security boundaries.
. Revert client_id header in JWTs used in OAuth2/OIDC - this is due to incorrect
  behaviour of some OAuth2 clients rejecting content of the protected header.
. Disable OIDC prompt=login - a number of issues were identified in this flow
  that are unable to be trivially fixed until a future release.
. Remove debug-symbols from release builds to reduce container image sizes.

- Changelog 1.10.1
. Resolve an incorrect javascript encoding of some fields that prevents new
  Webauthn enrolments from completing
. Correct incorrect text in TOTP CLI credential updates</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.4-1" date="1783944000">- Update to 1.10.4
. Security - High: LDAP BER Parsing did not contain a bound on their parsing
  depth allowing stack exhaustion to occur leading to Denial of Service by an
  unauthenticated user (reported by @kah-ja)

- Changelog 1.10.3
. Resolve an incorrect internal query that can prevent upgrades from 1.9 to
  1.10 in rare circumstances
. Resolve a unixd resolver deadlock that can occur during rare data conflict
  conditions</changelog>
</package>
<package pkgid="2b2d3e31c8e3dafceee4f15ce7d9b13bfcee4fe062df4863c2442d43f11839d5" name="kanidm-unixd-clients" arch="aarch64">
  <version epoch="0" ver="1.10.4" rel="1.el10"/>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.0-1" date="1777809600">- Initial package based on SUSE and J.B. Crawford Fedora packaging

- Important 1.10.0 Changes :
. OpenSSL is no longer required as a dependency. All cryptographic paths have
  been replaced by RustCrypto or Rustls using aws-lc-rs.
. Kanidm-unixd now supports bind mounts as an alternative to symlinks for home
  mapping.
. Account recovery can be enabled as a feature allowing a user to prove knowledge
  of their own email, and then have a credential reset email sent to them.
. Administrators can also trigger account recovery emails to be sent to users.</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.2-1" date="1777809601">- Update to 1.10.2
. Security - Critical: Any authenticated user is able to modify the attributes
  of any entry they have read permissions over. This is due to a logic flaw in
  modification access control application. Since all authenticated users are
  able to read all groups and group members, any authenticated user is able to
  add themself to any privileged group resulting in complete compromise of the
  servers security boundaries.
. Revert client_id header in JWTs used in OAuth2/OIDC - this is due to incorrect
  behaviour of some OAuth2 clients rejecting content of the protected header.
. Disable OIDC prompt=login - a number of issues were identified in this flow
  that are unable to be trivially fixed until a future release.
. Remove debug-symbols from release builds to reduce container image sizes.

- Changelog 1.10.1
. Resolve an incorrect javascript encoding of some fields that prevents new
  Webauthn enrolments from completing
. Correct incorrect text in TOTP CLI credential updates</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.4-1" date="1783944000">- Update to 1.10.4
. Security - High: LDAP BER Parsing did not contain a bound on their parsing
  depth allowing stack exhaustion to occur leading to Denial of Service by an
  unauthenticated user (reported by @kah-ja)

- Changelog 1.10.3
. Resolve an incorrect internal query that can prevent upgrades from 1.9 to
  1.10 in rare circumstances
. Resolve a unixd resolver deadlock that can occur during rare data conflict
  conditions</changelog>
</package>
<package pkgid="0c996b90e1fdb29051a11d7f1988b7f90c39ba02d2409efaa80349c079bdf319" name="kanidm-unixd-clients" arch="aarch64">
  <version epoch="0" ver="1.10.4" rel="1.el10"/>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.0-1" date="1777809600">- Initial package based on SUSE and J.B. Crawford Fedora packaging

- Important 1.10.0 Changes :
. OpenSSL is no longer required as a dependency. All cryptographic paths have
  been replaced by RustCrypto or Rustls using aws-lc-rs.
. Kanidm-unixd now supports bind mounts as an alternative to symlinks for home
  mapping.
. Account recovery can be enabled as a feature allowing a user to prove knowledge
  of their own email, and then have a credential reset email sent to them.
. Administrators can also trigger account recovery emails to be sent to users.</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.2-1" date="1777809601">- Update to 1.10.2
. Security - Critical: Any authenticated user is able to modify the attributes
  of any entry they have read permissions over. This is due to a logic flaw in
  modification access control application. Since all authenticated users are
  able to read all groups and group members, any authenticated user is able to
  add themself to any privileged group resulting in complete compromise of the
  servers security boundaries.
. Revert client_id header in JWTs used in OAuth2/OIDC - this is due to incorrect
  behaviour of some OAuth2 clients rejecting content of the protected header.
. Disable OIDC prompt=login - a number of issues were identified in this flow
  that are unable to be trivially fixed until a future release.
. Remove debug-symbols from release builds to reduce container image sizes.

- Changelog 1.10.1
. Resolve an incorrect javascript encoding of some fields that prevents new
  Webauthn enrolments from completing
. Correct incorrect text in TOTP CLI credential updates</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.4-1" date="1783944000">- Update to 1.10.4
. Security - High: LDAP BER Parsing did not contain a bound on their parsing
  depth allowing stack exhaustion to occur leading to Denial of Service by an
  unauthenticated user (reported by @kah-ja)

- Changelog 1.10.3
. Resolve an incorrect internal query that can prevent upgrades from 1.9 to
  1.10 in rare circumstances
. Resolve a unixd resolver deadlock that can occur during rare data conflict
  conditions</changelog>
</package>
<package pkgid="de5a8592c2bc6293701224bbae76f6de3fc75ba4c56a0d2bf2d44f5e14626d0b" name="kanidm-unixd-clients-debuginfo" arch="aarch64">
  <version epoch="0" ver="1.10.4" rel="1.el10"/>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.0-1" date="1777809600">- Initial package based on SUSE and J.B. Crawford Fedora packaging

- Important 1.10.0 Changes :
. OpenSSL is no longer required as a dependency. All cryptographic paths have
  been replaced by RustCrypto or Rustls using aws-lc-rs.
. Kanidm-unixd now supports bind mounts as an alternative to symlinks for home
  mapping.
. Account recovery can be enabled as a feature allowing a user to prove knowledge
  of their own email, and then have a credential reset email sent to them.
. Administrators can also trigger account recovery emails to be sent to users.</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.2-1" date="1777809601">- Update to 1.10.2
. Security - Critical: Any authenticated user is able to modify the attributes
  of any entry they have read permissions over. This is due to a logic flaw in
  modification access control application. Since all authenticated users are
  able to read all groups and group members, any authenticated user is able to
  add themself to any privileged group resulting in complete compromise of the
  servers security boundaries.
. Revert client_id header in JWTs used in OAuth2/OIDC - this is due to incorrect
  behaviour of some OAuth2 clients rejecting content of the protected header.
. Disable OIDC prompt=login - a number of issues were identified in this flow
  that are unable to be trivially fixed until a future release.
. Remove debug-symbols from release builds to reduce container image sizes.

- Changelog 1.10.1
. Resolve an incorrect javascript encoding of some fields that prevents new
  Webauthn enrolments from completing
. Correct incorrect text in TOTP CLI credential updates</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.4-1" date="1783944000">- Update to 1.10.4
. Security - High: LDAP BER Parsing did not contain a bound on their parsing
  depth allowing stack exhaustion to occur leading to Denial of Service by an
  unauthenticated user (reported by @kah-ja)

- Changelog 1.10.3
. Resolve an incorrect internal query that can prevent upgrades from 1.9 to
  1.10 in rare circumstances
. Resolve a unixd resolver deadlock that can occur during rare data conflict
  conditions</changelog>
</package>
<package pkgid="cbe972a2d4f3f1dbbc455f3996c76df1f896a3a1c04066254bf44607b2f29cab" name="kanidm-unixd-clients-debuginfo" arch="aarch64">
  <version epoch="0" ver="1.10.4" rel="1.el10"/>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.0-1" date="1777809600">- Initial package based on SUSE and J.B. Crawford Fedora packaging

- Important 1.10.0 Changes :
. OpenSSL is no longer required as a dependency. All cryptographic paths have
  been replaced by RustCrypto or Rustls using aws-lc-rs.
. Kanidm-unixd now supports bind mounts as an alternative to symlinks for home
  mapping.
. Account recovery can be enabled as a feature allowing a user to prove knowledge
  of their own email, and then have a credential reset email sent to them.
. Administrators can also trigger account recovery emails to be sent to users.</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.2-1" date="1777809601">- Update to 1.10.2
. Security - Critical: Any authenticated user is able to modify the attributes
  of any entry they have read permissions over. This is due to a logic flaw in
  modification access control application. Since all authenticated users are
  able to read all groups and group members, any authenticated user is able to
  add themself to any privileged group resulting in complete compromise of the
  servers security boundaries.
. Revert client_id header in JWTs used in OAuth2/OIDC - this is due to incorrect
  behaviour of some OAuth2 clients rejecting content of the protected header.
. Disable OIDC prompt=login - a number of issues were identified in this flow
  that are unable to be trivially fixed until a future release.
. Remove debug-symbols from release builds to reduce container image sizes.

- Changelog 1.10.1
. Resolve an incorrect javascript encoding of some fields that prevents new
  Webauthn enrolments from completing
. Correct incorrect text in TOTP CLI credential updates</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.10.4-1" date="1783944000">- Update to 1.10.4
. Security - High: LDAP BER Parsing did not contain a bound on their parsing
  depth allowing stack exhaustion to occur leading to Denial of Service by an
  unauthenticated user (reported by @kah-ja)

- Changelog 1.10.3
. Resolve an incorrect internal query that can prevent upgrades from 1.9 to
  1.10 in rare circumstances
. Resolve a unixd resolver deadlock that can occur during rare data conflict
  conditions</changelog>
</package>
<package pkgid="8268782e720fc2074b113bce6b25d0d1a7cdd5694d0e696b5340147bf2c5e2b8" name="mod_auth_mellon" arch="aarch64">
  <version epoch="0" ver="0.19.1" rel="2.el10"/>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 0.18.1-5" date="1705838400">- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 0.18.1-6" date="1706184000">- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild</changelog>
  <changelog author="Tomas Halman &lt;thalman@redhat.com&gt; - 0.19.0-1" date="1706184001">- Resolves: rhbz#2258342 - new version is available</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 0.19.0-2" date="1721304000">- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 0.19.0-3" date="1737115200">- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 0.19.0-4" date="1753358400">- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild</changelog>
  <changelog author="Xavier Bachelot &lt;xavier@bachelot.org&gt; - 0.19.1-1" date="1765195200">- Update to 0.19.1
- Fix bogus date in changelog
- Drop support for EOL releases</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 0.19.1-2" date="1768564800">- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild</changelog>
</package>
<package pkgid="5124b9c9d9ae260d4f09477dff1f8b17fd95f6f406a26a3b2615b2592e24c823" name="mod_auth_mellon" arch="src">
  <version epoch="0" ver="0.19.1" rel="2.el10"/>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 0.18.1-5" date="1705838400">- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 0.18.1-6" date="1706184000">- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild</changelog>
  <changelog author="Tomas Halman &lt;thalman@redhat.com&gt; - 0.19.0-1" date="1706184001">- Resolves: rhbz#2258342 - new version is available</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 0.19.0-2" date="1721304000">- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 0.19.0-3" date="1737115200">- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 0.19.0-4" date="1753358400">- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild</changelog>
  <changelog author="Xavier Bachelot &lt;xavier@bachelot.org&gt; - 0.19.1-1" date="1765195200">- Update to 0.19.1
- Fix bogus date in changelog
- Drop support for EOL releases</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 0.19.1-2" date="1768564800">- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild</changelog>
</package>
<package pkgid="607019a0a7448ac555908542f37a0b97b1bc9ba6626f78ee4233b02788fd0031" name="mod_auth_mellon-debuginfo" arch="aarch64">
  <version epoch="0" ver="0.19.1" rel="2.el10"/>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 0.18.1-5" date="1705838400">- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 0.18.1-6" date="1706184000">- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild</changelog>
  <changelog author="Tomas Halman &lt;thalman@redhat.com&gt; - 0.19.0-1" date="1706184001">- Resolves: rhbz#2258342 - new version is available</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 0.19.0-2" date="1721304000">- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 0.19.0-3" date="1737115200">- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 0.19.0-4" date="1753358400">- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild</changelog>
  <changelog author="Xavier Bachelot &lt;xavier@bachelot.org&gt; - 0.19.1-1" date="1765195200">- Update to 0.19.1
- Fix bogus date in changelog
- Drop support for EOL releases</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 0.19.1-2" date="1768564800">- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild</changelog>
</package>
<package pkgid="e3dff08323a18064b2c76988358f1482e98701e6b45ec493e873094bc9016471" name="mod_auth_mellon-debugsource" arch="aarch64">
  <version epoch="0" ver="0.19.1" rel="2.el10"/>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 0.18.1-5" date="1705838400">- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 0.18.1-6" date="1706184000">- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild</changelog>
  <changelog author="Tomas Halman &lt;thalman@redhat.com&gt; - 0.19.0-1" date="1706184001">- Resolves: rhbz#2258342 - new version is available</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 0.19.0-2" date="1721304000">- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 0.19.0-3" date="1737115200">- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 0.19.0-4" date="1753358400">- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild</changelog>
  <changelog author="Xavier Bachelot &lt;xavier@bachelot.org&gt; - 0.19.1-1" date="1765195200">- Update to 0.19.1
- Fix bogus date in changelog
- Drop support for EOL releases</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 0.19.1-2" date="1768564800">- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild</changelog>
</package>
<package pkgid="a4b06b6481578bc0d117325654c0be9689726b5add0745053e3bf0a3b775f411" name="mod_auth_mellon-diagnostics" arch="aarch64">
  <version epoch="0" ver="0.19.1" rel="2.el10"/>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 0.18.1-5" date="1705838400">- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 0.18.1-6" date="1706184000">- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild</changelog>
  <changelog author="Tomas Halman &lt;thalman@redhat.com&gt; - 0.19.0-1" date="1706184001">- Resolves: rhbz#2258342 - new version is available</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 0.19.0-2" date="1721304000">- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 0.19.0-3" date="1737115200">- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 0.19.0-4" date="1753358400">- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild</changelog>
  <changelog author="Xavier Bachelot &lt;xavier@bachelot.org&gt; - 0.19.1-1" date="1765195200">- Update to 0.19.1
- Fix bogus date in changelog
- Drop support for EOL releases</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 0.19.1-2" date="1768564800">- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild</changelog>
</package>
<package pkgid="cd813bcf4e90abcba1ff0432da44a4956bdd5143a7e70ad090e56736bbf206f5" name="mod_auth_mellon-diagnostics-debuginfo" arch="aarch64">
  <version epoch="0" ver="0.19.1" rel="2.el10"/>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 0.18.1-5" date="1705838400">- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 0.18.1-6" date="1706184000">- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild</changelog>
  <changelog author="Tomas Halman &lt;thalman@redhat.com&gt; - 0.19.0-1" date="1706184001">- Resolves: rhbz#2258342 - new version is available</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 0.19.0-2" date="1721304000">- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 0.19.0-3" date="1737115200">- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 0.19.0-4" date="1753358400">- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild</changelog>
  <changelog author="Xavier Bachelot &lt;xavier@bachelot.org&gt; - 0.19.1-1" date="1765195200">- Update to 0.19.1
- Fix bogus date in changelog
- Drop support for EOL releases</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 0.19.1-2" date="1768564800">- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild</changelog>
</package>
<package pkgid="fb09bfc7be012b96f1c459cf12cf5f1f0aedff82cd0cff2d2b8d75077de08f10" name="rustdesk-server" arch="aarch64">
  <version epoch="0" ver="1.1.14" rel="1.el10"/>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.1.14-1" date="1763208000">- Initial package</changelog>
</package>
<package pkgid="41bf224817e5b735e30c68dd91c480f097ecb5674d490202a700df306936fbb1" name="rustdesk-server" arch="src">
  <version epoch="0" ver="1.1.14" rel="1.el10"/>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.1.14-1" date="1763208000">- Initial package</changelog>
</package>
<package pkgid="a012bf6e3a5c8a58ad9d707fefed054619109e9950117330e3f8310d45356f06" name="rustdesk-server-debuginfo" arch="aarch64">
  <version epoch="0" ver="1.1.14" rel="1.el10"/>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.1.14-1" date="1763208000">- Initial package</changelog>
</package>
<package pkgid="dad32ee30026c17a8ac88583aa9a5fe900f2ee0e73b7df10ddc9e3c929b07788" name="rustdesk-server-debugsource" arch="aarch64">
  <version epoch="0" ver="1.1.14" rel="1.el10"/>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 1.1.14-1" date="1763208000">- Initial package</changelog>
</package>
</otherdata>