<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="3">
<package pkgid="14bc39552fc5093514137632129fc81dc97f452fd2cb5c7b3d38ab761d191b2a" name="stunnel" arch="src">
  <version epoch="0" ver="5.80" rel="126.1"/>
  <changelog author="michael@stroeder.com" date="1667304000">- Update to 5.67
  * New features
  - Provided a logging callback to custom engines.
  * Bugfixes
  - Fixed "make cert" with OpenSSL older than 3.0.
  - Fixed the code and the documentation to use conscious
    language for SNI servers (thx to Clemens Lang).</changelog>
  <changelog author="pmonreal@suse.com" date="1677240000">- Update to 5.68:
  * Security bugfixes
  - OpenSSL DLLs updated to version 3.0.8.
  * New features
  - Added the new 'CAengine' service-level option
    to load a trusted CA certificate from an engine.
  - Added requesting client certificates in server
    mode with 'CApath' besides 'CAfile'.
  * Bugfixes
  - Fixed EWOULDBLOCK errors in protocol negotiation.
  - Fixed handling TLS errors in protocol negotiation.
  - Prevented following fatal TLS alerts with TCP resets.
  - Improved OpenSSL initialization on WIN32.
  - Improved testing suite stability.
  - Improved file read performance.
  - Improved logging performance.</changelog>
  <changelog author="dmueller@suse.com" date="1680523200">- update to 5.69:
  * Improved logging performance with the "output" option.
  * Improved file read performance on the WIN32 platform.
  * DH and kDHEPSK ciphersuites removed from FIPS defaults.
  * Set the LimitNOFILE ulimit in stunnel.service to allow
  * for up to 10,000 concurrent clients.
  * Fixed the "CApath" option on the WIN32 platform by
  * applying https://github.com/openssl/openssl/pull/20312.
  * Fixed stunnel.spec used for building rpm packages.
  * Fixed tests on some OSes and architectures by merging</changelog>
  <changelog author="vetter@physik.uni-wuerzburg.de" date="1682510400">- Fix build on SLE12:
  - add macro make_build</changelog>
  <changelog author="vetter@physik.uni-wuerzburg.de" date="1689940800">- Update to 5.70:
  - Security bugfixes
  * OpenSSL DLLs updated to version 3.0.9.
  * OpenSSL FIPS Provider updated to version 3.0.8.
  - Bugfixes
  * Fixed TLS socket EOF handling with OpenSSL 3.x. This bug caused major interoperability issues between stunnel built with OpenSSL 3.x and Microsoft's Schannel Security Support Provider (SSP).
  * Fixed reading certificate chains from PKCS#12 files.
  - Features
  * Added configurable delay for the "retry" option.</changelog>
  <changelog author="pmonreal@suse.com" date="1694088000">- Enable bash completion support</changelog>
  <changelog author="pmonreal@suse.com" date="1694088001">- Enable crypto-policies support: [bsc#1211301]
  * The system's crypto-policies are the best source to determine
    which cipher suites to accept in TLS. OpenSSL supports the
    PROFILE=SYSTEM setting to use those policies. Change stunnel
    to default to the system settings.
  * Add patches:
  - stunnel-5.69-system-ciphers.patch
  - stunnel-5.69-default-tls-version.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1695643200">- Update to 5.71:
  * Security bugfixes:
  - OpenSSL DLLs updated to version 3.1.3.
  * Bugfixes:
  - Fixed the console output of tstunnel.exe.
  * Features sponsored by SAE IT-systems:
  - OCSP stapling is requested and verified in the client mode.
  - Using "verifyChain" automatically enables OCSP stapling in
    the client mode.
  - OCSP stapling is always available in the server mode.
  - An inconclusive OCSP verification breaks TLS negotiation.
    This can be disabled with "OCSPrequire = no".
  - Added the "TIMEOUTocsp" option to control the maximum time
    allowed for connecting an OCSP responder.
  * Features:
  - Added support for Red Hat OpenSSL 3.x patches.</changelog>
  <changelog author="vetter@physik.uni-wuerzburg.de" date="1707134400">- Provide user(stunnel) for rpm 4.19 change in Factory.</changelog>
  <changelog author="pmonreal@suse.com" date="1707912000">- Update to 5.72:
  * Security bugfixes:
  - OpenSSL DLLs updated to version 3.2.1.
  * Bugfixes:
  - Fixed SSL_CTX_new() errors handling.
  - Fixed OPENSSL_NO_PSK builds.
  - Android build updated for NDK r23c.
  - stunnel.nsi updated for Debian 12.
  - Fixed tests with OpenSSL older than 1.0.2.
  * Rebase stunnel-5.69-default-tls-version.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="pmonreal@suse.com" date="1727956800">- Update to 5.73:
  * Security bugfixes:
  - OpenSSL FIPS Provider updated to version 3.0.9.
  * Bugfixes:
  - Fixed a memory leak while reloading stunnel.conf sections
    with "client=yes" and "delay=no".
  - Fixed TIMEOUTocsp with values greater than 4.
  - Fix the IPv6 test on a non-IPv6 machine.
  * Features:
  - HELO replaced with EHLO in the post-STARTTLS SMTP protocol
    negotiation (thx to Peter Pentchev).
  - OCSP stapling fetches moved away from server threads.
  - Improved client-side session resumption.
  - Added support for the mimalloc allocator.
  - Check for protocolHost moved to configuration file processing
    for the client-side CONNECT protocol.
  - Clarified some confusing OpenSSL's certificate verification
    error messages.
  - Improved NetBSD compatibility.</changelog>
  <changelog author="pmonreal@suse.com" date="1736251200">- Update to version 5.74:
  * Bugfixes
  - Fixed a stapling cache deallocation crash.
  - Fixed "redirect" with protocol negotiation.
  * Features
  - "protocolHost" support for "socks" protocol clients.
  - More detailed logs in OpenSSL 3.0 or later.</changelog>
  <changelog author="pmonreal@suse.com" date="1748952000">- Update to version 5.75:
  * Security bugfixes
  - OpenSSL FIPS Provider updated to version 3.1.2.
  * Bugfixes
  - Fixed infinite loop triggered by OCSP URL parsing errors
  - Fixed OPENSSL_NO_OCSP build issues
  - Fixed default curve selection in FIPS mode with OpenSSL 3.4+.
  - Fixed tests with modern Python versions.
  - Fixed tests with multiple OpenSSL versions installed.
  * Features
  - Added provider URI support for "cert" and "key" options.
  - Added new "CAstore" service-level option (OpenSSL 3.0+).
  - Added "provider" (OpenSSL 3.0+), "providerParameter"
    (OpenSSL 3.5+), and "setEnv" global options.
  - Key file/URI path added to passphrase prompt on Unix.</changelog>
  <changelog author="pmonreal@suse.com" date="1762430400">- Update to 5.76:
  * Security bugfixes:
  - Service-level multivalued options now override (rather than
    append to) global defaults, preventing unintended configurations.
  * Bugfixes:
  - Fixed enabling/disabling of the default fips=yes property.
  - Missing OCSP stapling is no longer logged as an error.
  - Fixed a crash when a PIN was required due to the PKCS#11
    CKA_ALWAYS_AUTHENTICATE attribute.
  * Features:
  - Quantum-resistant hybrid key agreement X25519+ML-KEM-768
    (X25519MLKEM768) used by default with OpenSSL 3.5+ and TLS 1.3.
  - Multiple cert sources are supported, allowing a certificate to
    be fetched from a provider while loading the chain from a file.
  - Android build switched to a 16 KB page size.
  * Rebase stunnel-5.69-system-ciphers.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1769169600">- Adapt the .spec file for Immutable Mode [jsc#PED-14814]</changelog>
  <changelog author="pmonreal@suse.com" date="1772107200">- Update to 5.77:
  * Bugfixes
  - Avoid attempting to fetch OCSP stapling for PSK-only
    configuration sections.
  * Features
  - Merged applicable patches from Fedora and Debian:
  - Use SOURCE_DATE_EPOCH for reproducible builds.
  - Skip the OpenSSL version check when AUTOPKGTEST_TMP is set.
  - Enable PrivateTmp in the stunnel.service template.
  - Clarify the manual page for the "curves" option.
  - Log client IP addresses on TLS errors.</changelog>
  <changelog author="pmonreal@suse.com" date="1776081600">- Update to 5.78:
  * Bugfixes
  - Fixed a memory leak introduced in version 5.73.
  - Build fix for systems without timegm()
    (thanks to Jose A. Diaz and Shubham Gupta).
  - Fixed a startup crash when both global (default)
    and service-level lists of values are configured
    for an option.
  * Features
  - Support for zstd and brotli compression with OpenSSL 3.2
    and TLS 1.2 or older.
  - Support for new "options" parameter values.
  - Less bloated errors on an invalid configuration file.
  - Documentation updated from Pod to Pandoc Markdown.
  - Removed support for OpenSSL versions older than 0.9.8.
    The final update for the OpenSSL 0.9.7 branch
    (0.9.7m) was issed on 23 Feb 2007.</changelog>
  <changelog author="pmonreal@suse.com" date="1783339200">- Update to 5.79:
  * Security bugfixes
  - OpenSSL DLLs updated to version 3.5.7.
  * Bugfixes
  - Fixed a TCP stream truncation (thanks to Solomon Jacobs).
  - Fixed a transfer() loop (thanks to Solomon Jacobs).
  - Fixed log reopening logs without a configured log file.
  - Fixed some logged values (thanks to Jose Alf.).
  - Fixed some error handling and cleanup issues (thanks to Jose Alf.).
  - Fixed OpenSSL applink detection and MSYS2 MinGW builds.
  * Features
  - Added the new 'transport' service-level option
    to choose between TLS over TCP and DTLS over UDP.</changelog>
  <changelog author="pmonreal@suse.com" date="1786363200">- Update to 5.80:
  * Security bugfixes
  - CVE-2026-70368: Fixed an out-of-bounds memory access triggered
    by logging attacker-controlled protocol messages longer than 1,024
    bytes (thanks to AISLE Research and Clemens Lang) (bsc#1274206).
  - CVE-2026-70367: Fixed a SOCKS server mode bypass of the localhost
    destination filter using alternate local-address encodings and
    interface-scoped IPv6 destinations (thanks to AISLE Research and
    Clemens Lang) (bsc#1274207).
  - Restricted Windows GUI/service control pipes to local clients.
  * Bugfixes
  - Fixed concurrent DTLS handshakes from clients sharing an IP address.
  - Fixed version reporting in builds from source.
  - Rejected stream-oriented protocol negotiation with the UDP transport
    during configuration validation.
  * Features
  - Added the "CRLcheckChain" service-level option for opt-in
    full-chain CRL verification.</changelog>
</package>
<package pkgid="59076202c2c00ea57e3c8c26688755888e5b2f289969a9566d11bbad36f6be08" name="stunnel" arch="x86_64">
  <version epoch="0" ver="5.80" rel="126.1"/>
  <changelog author="michael@stroeder.com" date="1667304000">- Update to 5.67
  * New features
  - Provided a logging callback to custom engines.
  * Bugfixes
  - Fixed "make cert" with OpenSSL older than 3.0.
  - Fixed the code and the documentation to use conscious
    language for SNI servers (thx to Clemens Lang).</changelog>
  <changelog author="pmonreal@suse.com" date="1677240000">- Update to 5.68:
  * Security bugfixes
  - OpenSSL DLLs updated to version 3.0.8.
  * New features
  - Added the new 'CAengine' service-level option
    to load a trusted CA certificate from an engine.
  - Added requesting client certificates in server
    mode with 'CApath' besides 'CAfile'.
  * Bugfixes
  - Fixed EWOULDBLOCK errors in protocol negotiation.
  - Fixed handling TLS errors in protocol negotiation.
  - Prevented following fatal TLS alerts with TCP resets.
  - Improved OpenSSL initialization on WIN32.
  - Improved testing suite stability.
  - Improved file read performance.
  - Improved logging performance.</changelog>
  <changelog author="dmueller@suse.com" date="1680523200">- update to 5.69:
  * Improved logging performance with the "output" option.
  * Improved file read performance on the WIN32 platform.
  * DH and kDHEPSK ciphersuites removed from FIPS defaults.
  * Set the LimitNOFILE ulimit in stunnel.service to allow
  * for up to 10,000 concurrent clients.
  * Fixed the "CApath" option on the WIN32 platform by
  * applying https://github.com/openssl/openssl/pull/20312.
  * Fixed stunnel.spec used for building rpm packages.
  * Fixed tests on some OSes and architectures by merging</changelog>
  <changelog author="vetter@physik.uni-wuerzburg.de" date="1682510400">- Fix build on SLE12:
  - add macro make_build</changelog>
  <changelog author="vetter@physik.uni-wuerzburg.de" date="1689940800">- Update to 5.70:
  - Security bugfixes
  * OpenSSL DLLs updated to version 3.0.9.
  * OpenSSL FIPS Provider updated to version 3.0.8.
  - Bugfixes
  * Fixed TLS socket EOF handling with OpenSSL 3.x. This bug caused major interoperability issues between stunnel built with OpenSSL 3.x and Microsoft's Schannel Security Support Provider (SSP).
  * Fixed reading certificate chains from PKCS#12 files.
  - Features
  * Added configurable delay for the "retry" option.</changelog>
  <changelog author="pmonreal@suse.com" date="1694088000">- Enable bash completion support</changelog>
  <changelog author="pmonreal@suse.com" date="1694088001">- Enable crypto-policies support: [bsc#1211301]
  * The system's crypto-policies are the best source to determine
    which cipher suites to accept in TLS. OpenSSL supports the
    PROFILE=SYSTEM setting to use those policies. Change stunnel
    to default to the system settings.
  * Add patches:
  - stunnel-5.69-system-ciphers.patch
  - stunnel-5.69-default-tls-version.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1695643200">- Update to 5.71:
  * Security bugfixes:
  - OpenSSL DLLs updated to version 3.1.3.
  * Bugfixes:
  - Fixed the console output of tstunnel.exe.
  * Features sponsored by SAE IT-systems:
  - OCSP stapling is requested and verified in the client mode.
  - Using "verifyChain" automatically enables OCSP stapling in
    the client mode.
  - OCSP stapling is always available in the server mode.
  - An inconclusive OCSP verification breaks TLS negotiation.
    This can be disabled with "OCSPrequire = no".
  - Added the "TIMEOUTocsp" option to control the maximum time
    allowed for connecting an OCSP responder.
  * Features:
  - Added support for Red Hat OpenSSL 3.x patches.</changelog>
  <changelog author="vetter@physik.uni-wuerzburg.de" date="1707134400">- Provide user(stunnel) for rpm 4.19 change in Factory.</changelog>
  <changelog author="pmonreal@suse.com" date="1707912000">- Update to 5.72:
  * Security bugfixes:
  - OpenSSL DLLs updated to version 3.2.1.
  * Bugfixes:
  - Fixed SSL_CTX_new() errors handling.
  - Fixed OPENSSL_NO_PSK builds.
  - Android build updated for NDK r23c.
  - stunnel.nsi updated for Debian 12.
  - Fixed tests with OpenSSL older than 1.0.2.
  * Rebase stunnel-5.69-default-tls-version.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="pmonreal@suse.com" date="1727956800">- Update to 5.73:
  * Security bugfixes:
  - OpenSSL FIPS Provider updated to version 3.0.9.
  * Bugfixes:
  - Fixed a memory leak while reloading stunnel.conf sections
    with "client=yes" and "delay=no".
  - Fixed TIMEOUTocsp with values greater than 4.
  - Fix the IPv6 test on a non-IPv6 machine.
  * Features:
  - HELO replaced with EHLO in the post-STARTTLS SMTP protocol
    negotiation (thx to Peter Pentchev).
  - OCSP stapling fetches moved away from server threads.
  - Improved client-side session resumption.
  - Added support for the mimalloc allocator.
  - Check for protocolHost moved to configuration file processing
    for the client-side CONNECT protocol.
  - Clarified some confusing OpenSSL's certificate verification
    error messages.
  - Improved NetBSD compatibility.</changelog>
  <changelog author="pmonreal@suse.com" date="1736251200">- Update to version 5.74:
  * Bugfixes
  - Fixed a stapling cache deallocation crash.
  - Fixed "redirect" with protocol negotiation.
  * Features
  - "protocolHost" support for "socks" protocol clients.
  - More detailed logs in OpenSSL 3.0 or later.</changelog>
  <changelog author="pmonreal@suse.com" date="1748952000">- Update to version 5.75:
  * Security bugfixes
  - OpenSSL FIPS Provider updated to version 3.1.2.
  * Bugfixes
  - Fixed infinite loop triggered by OCSP URL parsing errors
  - Fixed OPENSSL_NO_OCSP build issues
  - Fixed default curve selection in FIPS mode with OpenSSL 3.4+.
  - Fixed tests with modern Python versions.
  - Fixed tests with multiple OpenSSL versions installed.
  * Features
  - Added provider URI support for "cert" and "key" options.
  - Added new "CAstore" service-level option (OpenSSL 3.0+).
  - Added "provider" (OpenSSL 3.0+), "providerParameter"
    (OpenSSL 3.5+), and "setEnv" global options.
  - Key file/URI path added to passphrase prompt on Unix.</changelog>
  <changelog author="pmonreal@suse.com" date="1762430400">- Update to 5.76:
  * Security bugfixes:
  - Service-level multivalued options now override (rather than
    append to) global defaults, preventing unintended configurations.
  * Bugfixes:
  - Fixed enabling/disabling of the default fips=yes property.
  - Missing OCSP stapling is no longer logged as an error.
  - Fixed a crash when a PIN was required due to the PKCS#11
    CKA_ALWAYS_AUTHENTICATE attribute.
  * Features:
  - Quantum-resistant hybrid key agreement X25519+ML-KEM-768
    (X25519MLKEM768) used by default with OpenSSL 3.5+ and TLS 1.3.
  - Multiple cert sources are supported, allowing a certificate to
    be fetched from a provider while loading the chain from a file.
  - Android build switched to a 16 KB page size.
  * Rebase stunnel-5.69-system-ciphers.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1769169600">- Adapt the .spec file for Immutable Mode [jsc#PED-14814]</changelog>
  <changelog author="pmonreal@suse.com" date="1772107200">- Update to 5.77:
  * Bugfixes
  - Avoid attempting to fetch OCSP stapling for PSK-only
    configuration sections.
  * Features
  - Merged applicable patches from Fedora and Debian:
  - Use SOURCE_DATE_EPOCH for reproducible builds.
  - Skip the OpenSSL version check when AUTOPKGTEST_TMP is set.
  - Enable PrivateTmp in the stunnel.service template.
  - Clarify the manual page for the "curves" option.
  - Log client IP addresses on TLS errors.</changelog>
  <changelog author="pmonreal@suse.com" date="1776081600">- Update to 5.78:
  * Bugfixes
  - Fixed a memory leak introduced in version 5.73.
  - Build fix for systems without timegm()
    (thanks to Jose A. Diaz and Shubham Gupta).
  - Fixed a startup crash when both global (default)
    and service-level lists of values are configured
    for an option.
  * Features
  - Support for zstd and brotli compression with OpenSSL 3.2
    and TLS 1.2 or older.
  - Support for new "options" parameter values.
  - Less bloated errors on an invalid configuration file.
  - Documentation updated from Pod to Pandoc Markdown.
  - Removed support for OpenSSL versions older than 0.9.8.
    The final update for the OpenSSL 0.9.7 branch
    (0.9.7m) was issed on 23 Feb 2007.</changelog>
  <changelog author="pmonreal@suse.com" date="1783339200">- Update to 5.79:
  * Security bugfixes
  - OpenSSL DLLs updated to version 3.5.7.
  * Bugfixes
  - Fixed a TCP stream truncation (thanks to Solomon Jacobs).
  - Fixed a transfer() loop (thanks to Solomon Jacobs).
  - Fixed log reopening logs without a configured log file.
  - Fixed some logged values (thanks to Jose Alf.).
  - Fixed some error handling and cleanup issues (thanks to Jose Alf.).
  - Fixed OpenSSL applink detection and MSYS2 MinGW builds.
  * Features
  - Added the new 'transport' service-level option
    to choose between TLS over TCP and DTLS over UDP.</changelog>
  <changelog author="pmonreal@suse.com" date="1786363200">- Update to 5.80:
  * Security bugfixes
  - CVE-2026-70368: Fixed an out-of-bounds memory access triggered
    by logging attacker-controlled protocol messages longer than 1,024
    bytes (thanks to AISLE Research and Clemens Lang) (bsc#1274206).
  - CVE-2026-70367: Fixed a SOCKS server mode bypass of the localhost
    destination filter using alternate local-address encodings and
    interface-scoped IPv6 destinations (thanks to AISLE Research and
    Clemens Lang) (bsc#1274207).
  - Restricted Windows GUI/service control pipes to local clients.
  * Bugfixes
  - Fixed concurrent DTLS handshakes from clients sharing an IP address.
  - Fixed version reporting in builds from source.
  - Rejected stream-oriented protocol negotiation with the UDP transport
    during configuration validation.
  * Features
  - Added the "CRLcheckChain" service-level option for opt-in
    full-chain CRL verification.</changelog>
</package>
<package pkgid="2e696c44cc791d0c7ed04a42c1158e4a8f7a8b998b36903192c231a5ad0134aa" name="stunnel-doc" arch="noarch">
  <version epoch="0" ver="5.80" rel="126.1"/>
  <changelog author="michael@stroeder.com" date="1667304000">- Update to 5.67
  * New features
  - Provided a logging callback to custom engines.
  * Bugfixes
  - Fixed "make cert" with OpenSSL older than 3.0.
  - Fixed the code and the documentation to use conscious
    language for SNI servers (thx to Clemens Lang).</changelog>
  <changelog author="pmonreal@suse.com" date="1677240000">- Update to 5.68:
  * Security bugfixes
  - OpenSSL DLLs updated to version 3.0.8.
  * New features
  - Added the new 'CAengine' service-level option
    to load a trusted CA certificate from an engine.
  - Added requesting client certificates in server
    mode with 'CApath' besides 'CAfile'.
  * Bugfixes
  - Fixed EWOULDBLOCK errors in protocol negotiation.
  - Fixed handling TLS errors in protocol negotiation.
  - Prevented following fatal TLS alerts with TCP resets.
  - Improved OpenSSL initialization on WIN32.
  - Improved testing suite stability.
  - Improved file read performance.
  - Improved logging performance.</changelog>
  <changelog author="dmueller@suse.com" date="1680523200">- update to 5.69:
  * Improved logging performance with the "output" option.
  * Improved file read performance on the WIN32 platform.
  * DH and kDHEPSK ciphersuites removed from FIPS defaults.
  * Set the LimitNOFILE ulimit in stunnel.service to allow
  * for up to 10,000 concurrent clients.
  * Fixed the "CApath" option on the WIN32 platform by
  * applying https://github.com/openssl/openssl/pull/20312.
  * Fixed stunnel.spec used for building rpm packages.
  * Fixed tests on some OSes and architectures by merging</changelog>
  <changelog author="vetter@physik.uni-wuerzburg.de" date="1682510400">- Fix build on SLE12:
  - add macro make_build</changelog>
  <changelog author="vetter@physik.uni-wuerzburg.de" date="1689940800">- Update to 5.70:
  - Security bugfixes
  * OpenSSL DLLs updated to version 3.0.9.
  * OpenSSL FIPS Provider updated to version 3.0.8.
  - Bugfixes
  * Fixed TLS socket EOF handling with OpenSSL 3.x. This bug caused major interoperability issues between stunnel built with OpenSSL 3.x and Microsoft's Schannel Security Support Provider (SSP).
  * Fixed reading certificate chains from PKCS#12 files.
  - Features
  * Added configurable delay for the "retry" option.</changelog>
  <changelog author="pmonreal@suse.com" date="1694088000">- Enable bash completion support</changelog>
  <changelog author="pmonreal@suse.com" date="1694088001">- Enable crypto-policies support: [bsc#1211301]
  * The system's crypto-policies are the best source to determine
    which cipher suites to accept in TLS. OpenSSL supports the
    PROFILE=SYSTEM setting to use those policies. Change stunnel
    to default to the system settings.
  * Add patches:
  - stunnel-5.69-system-ciphers.patch
  - stunnel-5.69-default-tls-version.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1695643200">- Update to 5.71:
  * Security bugfixes:
  - OpenSSL DLLs updated to version 3.1.3.
  * Bugfixes:
  - Fixed the console output of tstunnel.exe.
  * Features sponsored by SAE IT-systems:
  - OCSP stapling is requested and verified in the client mode.
  - Using "verifyChain" automatically enables OCSP stapling in
    the client mode.
  - OCSP stapling is always available in the server mode.
  - An inconclusive OCSP verification breaks TLS negotiation.
    This can be disabled with "OCSPrequire = no".
  - Added the "TIMEOUTocsp" option to control the maximum time
    allowed for connecting an OCSP responder.
  * Features:
  - Added support for Red Hat OpenSSL 3.x patches.</changelog>
  <changelog author="vetter@physik.uni-wuerzburg.de" date="1707134400">- Provide user(stunnel) for rpm 4.19 change in Factory.</changelog>
  <changelog author="pmonreal@suse.com" date="1707912000">- Update to 5.72:
  * Security bugfixes:
  - OpenSSL DLLs updated to version 3.2.1.
  * Bugfixes:
  - Fixed SSL_CTX_new() errors handling.
  - Fixed OPENSSL_NO_PSK builds.
  - Android build updated for NDK r23c.
  - stunnel.nsi updated for Debian 12.
  - Fixed tests with OpenSSL older than 1.0.2.
  * Rebase stunnel-5.69-default-tls-version.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="pmonreal@suse.com" date="1727956800">- Update to 5.73:
  * Security bugfixes:
  - OpenSSL FIPS Provider updated to version 3.0.9.
  * Bugfixes:
  - Fixed a memory leak while reloading stunnel.conf sections
    with "client=yes" and "delay=no".
  - Fixed TIMEOUTocsp with values greater than 4.
  - Fix the IPv6 test on a non-IPv6 machine.
  * Features:
  - HELO replaced with EHLO in the post-STARTTLS SMTP protocol
    negotiation (thx to Peter Pentchev).
  - OCSP stapling fetches moved away from server threads.
  - Improved client-side session resumption.
  - Added support for the mimalloc allocator.
  - Check for protocolHost moved to configuration file processing
    for the client-side CONNECT protocol.
  - Clarified some confusing OpenSSL's certificate verification
    error messages.
  - Improved NetBSD compatibility.</changelog>
  <changelog author="pmonreal@suse.com" date="1736251200">- Update to version 5.74:
  * Bugfixes
  - Fixed a stapling cache deallocation crash.
  - Fixed "redirect" with protocol negotiation.
  * Features
  - "protocolHost" support for "socks" protocol clients.
  - More detailed logs in OpenSSL 3.0 or later.</changelog>
  <changelog author="pmonreal@suse.com" date="1748952000">- Update to version 5.75:
  * Security bugfixes
  - OpenSSL FIPS Provider updated to version 3.1.2.
  * Bugfixes
  - Fixed infinite loop triggered by OCSP URL parsing errors
  - Fixed OPENSSL_NO_OCSP build issues
  - Fixed default curve selection in FIPS mode with OpenSSL 3.4+.
  - Fixed tests with modern Python versions.
  - Fixed tests with multiple OpenSSL versions installed.
  * Features
  - Added provider URI support for "cert" and "key" options.
  - Added new "CAstore" service-level option (OpenSSL 3.0+).
  - Added "provider" (OpenSSL 3.0+), "providerParameter"
    (OpenSSL 3.5+), and "setEnv" global options.
  - Key file/URI path added to passphrase prompt on Unix.</changelog>
  <changelog author="pmonreal@suse.com" date="1762430400">- Update to 5.76:
  * Security bugfixes:
  - Service-level multivalued options now override (rather than
    append to) global defaults, preventing unintended configurations.
  * Bugfixes:
  - Fixed enabling/disabling of the default fips=yes property.
  - Missing OCSP stapling is no longer logged as an error.
  - Fixed a crash when a PIN was required due to the PKCS#11
    CKA_ALWAYS_AUTHENTICATE attribute.
  * Features:
  - Quantum-resistant hybrid key agreement X25519+ML-KEM-768
    (X25519MLKEM768) used by default with OpenSSL 3.5+ and TLS 1.3.
  - Multiple cert sources are supported, allowing a certificate to
    be fetched from a provider while loading the chain from a file.
  - Android build switched to a 16 KB page size.
  * Rebase stunnel-5.69-system-ciphers.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1769169600">- Adapt the .spec file for Immutable Mode [jsc#PED-14814]</changelog>
  <changelog author="pmonreal@suse.com" date="1772107200">- Update to 5.77:
  * Bugfixes
  - Avoid attempting to fetch OCSP stapling for PSK-only
    configuration sections.
  * Features
  - Merged applicable patches from Fedora and Debian:
  - Use SOURCE_DATE_EPOCH for reproducible builds.
  - Skip the OpenSSL version check when AUTOPKGTEST_TMP is set.
  - Enable PrivateTmp in the stunnel.service template.
  - Clarify the manual page for the "curves" option.
  - Log client IP addresses on TLS errors.</changelog>
  <changelog author="pmonreal@suse.com" date="1776081600">- Update to 5.78:
  * Bugfixes
  - Fixed a memory leak introduced in version 5.73.
  - Build fix for systems without timegm()
    (thanks to Jose A. Diaz and Shubham Gupta).
  - Fixed a startup crash when both global (default)
    and service-level lists of values are configured
    for an option.
  * Features
  - Support for zstd and brotli compression with OpenSSL 3.2
    and TLS 1.2 or older.
  - Support for new "options" parameter values.
  - Less bloated errors on an invalid configuration file.
  - Documentation updated from Pod to Pandoc Markdown.
  - Removed support for OpenSSL versions older than 0.9.8.
    The final update for the OpenSSL 0.9.7 branch
    (0.9.7m) was issed on 23 Feb 2007.</changelog>
  <changelog author="pmonreal@suse.com" date="1783339200">- Update to 5.79:
  * Security bugfixes
  - OpenSSL DLLs updated to version 3.5.7.
  * Bugfixes
  - Fixed a TCP stream truncation (thanks to Solomon Jacobs).
  - Fixed a transfer() loop (thanks to Solomon Jacobs).
  - Fixed log reopening logs without a configured log file.
  - Fixed some logged values (thanks to Jose Alf.).
  - Fixed some error handling and cleanup issues (thanks to Jose Alf.).
  - Fixed OpenSSL applink detection and MSYS2 MinGW builds.
  * Features
  - Added the new 'transport' service-level option
    to choose between TLS over TCP and DTLS over UDP.</changelog>
  <changelog author="pmonreal@suse.com" date="1786363200">- Update to 5.80:
  * Security bugfixes
  - CVE-2026-70368: Fixed an out-of-bounds memory access triggered
    by logging attacker-controlled protocol messages longer than 1,024
    bytes (thanks to AISLE Research and Clemens Lang) (bsc#1274206).
  - CVE-2026-70367: Fixed a SOCKS server mode bypass of the localhost
    destination filter using alternate local-address encodings and
    interface-scoped IPv6 destinations (thanks to AISLE Research and
    Clemens Lang) (bsc#1274207).
  - Restricted Windows GUI/service control pipes to local clients.
  * Bugfixes
  - Fixed concurrent DTLS handshakes from clients sharing an IP address.
  - Fixed version reporting in builds from source.
  - Rejected stream-oriented protocol negotiation with the UDP transport
    during configuration validation.
  * Features
  - Added the "CRLcheckChain" service-level option for opt-in
    full-chain CRL verification.</changelog>
</package>
</otherdata>