# changelog

author: Lawrence Rogers <lrr@cert.org> 1.0-97
changelog:
  * Release 1.0-97
  	Removed the following for Fedora 35
  	  * vinetto
  	  * Volatility-community-plugins
  	  * shellbags
  	  * binplist


author: Lawrence Rogers <lrr@cert.org> 1.0-100
changelog:
  * Release 1.0-100
  	Added the following packages:
  	 * crunch
  	 * docker-forensics-toolkit
  	 * KStrike
  	 * libfplist
  	 * libfwevt
  	 * libfwps
  	 * mtftar
  	 * pstotext
  	 * pyfixbuf
  	 * VeraCrypt
  	 * videosnarf
  	 * wdpassport-utils
  	 * zeek


author: Lawrence Rogers <lrr@cert.org> 1.0-101
changelog:
  * Release 1.0-101
  	Added the following packages:
  	 * python3-oletools
  	 * python-oletools-doc
  	 * mmc-utils


author: Lawrence Rogers <lrr@cert.org> 1.0-102
changelog:
  * Release 1.0-102
  	Removed the following packages:
  	 * ssldump from CentOS/RHEL 8
  	Obsoleted the following packages:
  	 * cutter-re from CentOS/RHEL8


author: Lawrence R. Rogers <lrr@cert.org> 2.6.1-7
changelog:
  * Release 2.6.1-7
  	This version uses a container based on Alpine Linux
  	The container can be found at certlifter/Volatility-2.6.1:8.
  	Note that the Dockerfile is provided as part of this package.


author: Lawrence R. Rogers <lrr@cert.org> 2.6.1-8
changelog:
  * Release 2.6.1-8
  	The errors in the script and logic changes have been corrected by the patch.
  	The container is now based on CentOS 7.9.2009 and uses volatility from LiFTeR as well as the community plugins.


author: Miro Hrončok <mhroncok@redhat.com> - 3.7.16-7
changelog:
  - Update Python macros to new packaging standards
    (See https://fedoraproject.org/wiki/Changes/Move_usr_bin_python_into_separate_package)


author: Michal Ambroz <rebus _AT seznam.cz> - 3.7.18-1
changelog:
  - bump to 3.7.18 which contains:
  - Remove upstream patch Sanity-check-size-passed-to-malloc.patch
  - Fix affverify failing due to context being freed too soon
  - Fix pyaff build issue with newer Python (3.7) and cython (0.29)
  - from version 3.7.17
  - fix #34: option typo (25 minutes ago)
  - minor fixes to configure.ac (3 months ago)
  - Fix issue #32, an off-by-one buffer overflow (6 months ago)
  - whitespace (6 months ago)
  - Sanity check size passed to malloc... (6 months ago)
  - Fix incrementing in vnode_split_raw.cpp for comment consistnecy (12 months ago)
  - Update Win32 readmes to fix issue #26. (1 year, 2 months ago)
  - build python3 package


author: Lawrence R. Rogers <lrr@cert.org> 5.11.4-1
changelog:
  * Release 5.11.4.1
  	Version 5.11.4
  	  Updated to allow compilation with fixbuf-2.0.0 or fixbuf-3.0.0. Notes:
  	   Processing IPFIX produced by YAF 3 is experimental and not recommended.
  	   Ensure the SchemaTools and SiLK dependencies use the same version of libfixbuf.
  	 Fixed an issue on macOS that prevented configure from finding SiLK.
  	 Updated CERT IPFIX elements to include those added in YAF 3. This update does not include the element name changes that were part of that release.


author: Lawrence R. Rogers <lrr@cert.org> - 2.0.16-1
changelog:
  - Release 2.0.16
  	v2.0.16,05/21/2015 - Documentation fix and attribute fixes based on NTFS version with thanks to Joachim Metz


author: Lawrence R. Rogers <lrr@cert.org> - 2.0.19-1
changelog:
  - Release 2.0.19
  	v2.0.19,05/27/2016 - (Contributed by lespea)
  			   - Properly deal with fncnt findings > 3
  			   - Allow the user to use either windows or unix path seperators
  			   - General code cleanup


author: Lawrence R. Rogers <lrr@cert.org> 4.15.0-3
changelog:
  * Release 4.15.0-3
  	Fix problem in CentOS/RHEL 7 version. 
  	And reverted back to the JDK that comes with the OS and away from BelLSoft.


author: Lawrence R. Rogers <lrr@cert.org> 4.16.0-1
changelog:
  * Release 4.16.0-1
  	Ingest:
  		Added streaming ingest capability for disk images that allow files to be analyzed as soon as they are added to the database.
  		Changed backend code so that disk image-based files are added by Java code instead of C/C++ code.
  	Ingest Modules:
  		Include Interesting File set rules for cloud storage, encryption, cryptocurrency and privacy programs.
  		Updated PhotoRec 7.1 and include 64-bit version.
  		Updated RegRipper in Recent Activity to 2.8
  		Create artifacts for Prefetch, Background Activity Monitor, and System Resource Usage.
  		Support MBOX files greater than 2GB.
  		Document metadata is saved as explicit artifacts and added to the timeline.
  		New “no change” hashset type that does not change status of file.
  	Central Repository / Personas:
  		Accounts in the Central Repository can be grouped together and associated with a digital persona.
  		All accounts are now stored in the Central Repository to support correlation and persona creation.
  	Content viewers:
  		Created artifact-specific viewers in the Results viewer for contact book and call log.
  		Moved Message viewer to a Results sub-viewer and expanded to show accounts.
  		Added Application sub-viewer for PDF files based on IcePDF.
  		Annotation viewer now includes comments from hash set hits.
  	Geolocation Viewer:
  		Different data types now are displayed using different colors.
  		Track points in a track are now displayed as small, connected circles instead of full pins.
  		Filter panel shows only data sources with geo location data.
  		Geolocation artifact points can be tagged and commented upon.
  	File Discovery:
  		Changed UI to have more of a search flow and content viewer is hidden until an item is selected.
  	Reports:
  		Can be generated for a single data source instead of the entire case.
  		CASE / UCO report module now includes artifacts in addition to files.
  		Added backend concept of Tag Sets to support Project Vic categories from different countries.
  	Performance:
  		Add throttling of UI refreshes to ensure data is quickly displayed and the tree does not get backed up with requests.
  		Improved efficiency of adding a data source with many orphan files.
  		Improved efficiency of loading file systems.
  		Jython interpreter is preloaded at application startup.
  	Misc bug fixes and improvements:
  		Fixed bug from last release where hex content viewer text was no longer fixed width.
  		Altered locking to allow multiple data sources to be added at once more smoothly and to support batch inserts of file data.
  		Central repository comments will no longer store tag descriptions.
  		Account type nodes in the Accounts tree show counts.
  		Full time stamps displayed for messages in ingest inbox.
  		More detailed status during file exports.
  		Improved efficiency of adding timeline events.
  		Fixed bug with CVT most recent filter.
  		Improved documentation and support for running on Linux/macOS.


author: Lawrence R. Rogers <lrr@cert.org> 4.17.0-1
changelog:
  * Release 4.17.0-1
  	GUI:
  		Expanded the Data Source Summary panel to show recent activity, past cases, analysis results, etc.  Also made this available from the main UI when a data source is selected.
  		Expanded Discovery UI to support searching for and basic display of web domains.  It collapses the various web artifacts into a single view.
  	Ingest Modules:
  		Added iOS Analyzer module based on iLEAPP and a subset of its artifacts.
  		New Picture Analyzer module that does EXIF extraction and HEIC conversion. HEIC/HEIF images are converted to JPEGs that retain EXIF using ImageMagick (replaces the previous EXIF ingest module).
  		Added support for the latest version of Edge browser that is based on Chromium into Recent Activity. Other Chromium-based browsers are also supported.
  		Updated the rules that search Web History artifacts for search queries.  Expanded module to support multiple search engines for ambiguous URLs.
  		Bluetooth pairing artifacts are created based on RegRipper output.
  		Prefetch artifacts record the full path of exes.
  		PhotoRec module allows you to include or exclude specific file types.
  		Upgraded to Tika 1.23.
  	Performance:
  		Documents are added to Solr in batches instead of one by one.
  		More efficient queries to find WAL files for SQLite databases.
  		Use a local drive for temp files for multi-user cases instead of the shared folder.
  	Command Line
  		Command line support for report profiles.
  		Restored support for Windows file type association for opening a case in Autopsy by double clicking case metadata (.aut) file.
  		Better feedback for command line argument errors.
  	Misc:
  		Updated versions of libvmdk, libvhdi, and libewf.
  		Persona UI fixes: Pre-populate account and changed order of New Persona dialog.
  		Streaming ingest support added to auto ingest.
  		Recent Activity module processes now use the global timeout.
  		Option to include Autopsy executable in portable case (Windows only.)
  		Upgraded to NetBeans 11 Rich Client Platform.
  		Added debug feature to save the stack trace on all threads.


author: Lawrence R. Rogers <lrr@cert.org> 4.18.0-1
changelog:
  * Release 4.18.0-1
  	Keyword Search:
  		A major upgrade from Solr 4 to Solr 8.6.3.  Single user cases continue to use the embedded server.  
  		Multi-user clusters need to install a new Solr 8 server and can now create a Solr cloud with multiple servers. 
  		   NOTE: Cases created with Autopsy 4.18 cannot be opened by previous versions of Autopsy.  Autopsy 4.18 can open older cases though. 
  		See http://sleuthkit.org/autopsy/docs/user-docs/4.18.0/upgrade_solr8_page.html for more details. 
  		Improved text indexing speed by not doing language detection on unknown file formats and unallocated space. 
  	Domain Discovery:
  		Added details view to Domain Discovery to show what web-based artifacts are associated with the selected domain. 
  		Updated the Domain Discovery grouping and sorting by options. 
  		Added basic domain categorization for webmail-based domains.
  	Content Viewers:
  		Built more specialized viewers for web-based artifacts.
  	Data Source Summary: 
  		Added a “Geolocations” tab that shows what cities the data source was near (based on geolocation data).
  		Added a “Timeline” tab that shows counts of events from the last 30 days the data source was used. 
  		Added navigation buttons to jump from the summary view to the main Autopsy UI (for example to go to the map). 
  	Ingest Modules:
  		New YARA ingest module to flag files based on regular expression patterns. 
  		New “Android Analyzer (aLEAPP)” module based on aLEAPP.  Previous “Android Analyzer” also still exists. 
  		Updated “iOS Analyzer (iLEAPP)” module to create more artifacts and work on disk images. 
  		Hash Database module will calculate SHA-256 hash in addition to MD5.
  		Removed Interesting Item rule that flagged existence of Bitlocker (since it ships with Windows). 
  		Fixed a major bug in the PhotoRec module that could result in an incorrect file layout if the carved file spanned non-contiguous sectors. 
  		Fixed MBOX detection bug in Email module. 
  	Reporting:
  		Attachments from tagged messages are now included in a Portable Case. 
  	Misc:
  		Added support for Ext4 inline data and sparse blocks (via TSK fix).
  		Updated PostgreSQL JDBC driver to support any recent version of PostgreSQL for multi-user cases and PostgreSQL Central Repository.
  		Added personas to the summary viewer in CVT.
  		Handling of bad characters in auto ingest manifest files.
  		Assorted small bug fixes.


author: Lawrence R. Rogers <lrr@cert.org> 4.19.0-1
changelog:
  * Release 4.19.0-1
  	Data Source Management:
  	- To make managing big cases easier, all data sources are now associated with a host that can be specified in the “Add Data Source” wizard. 
  	- Hosts can be grouped by “person”, which is simply a name of the owner.
  	- The main tree viewer can be configured to group by person and host. 

  	OS Accounts:
  	- Operating System (OS) accounts and realms are their own data types and no longer generic artifacts. 
  	- OS Accounts are created for Windows accounts found in the registry. Domain-scoped realms are not fully detected yet. 
  	- NTFS files are associated with OS Accounts by SID. 
  	- The Recent Activity module associates artifacts with OS Accounts based on SID or path of database.  Other modules still need to be updated. 
  	- OS accounts appear in a dedicated sub-tree of the main tree view and their properties can be viewed in the results view.
  	- A new content viewer in the lower right area of the main window was built to display OS account data for the item selected in the results view.

  	Analysis Result and Data Artifacts
  	- All modules make either Analysis Results or Data Artifacts instead of “Blackboard Artifacts.”
  	- New “Analysis Result” content viewer shows the results for a given file and its score.
  	- The tabular results viewer shows an icon for the aggregate score of a file. 
  	- The tree organizes results into "Analysis Results" and "Data Artifacts" instead of simply “Results.” 

  	Discovery UI:
  	- Domain categorization and account types are displayed in Domain Discovery results.
  	- The Domain Discovery results view more explicitly shows when a downloaded file no longer exists. 
  	- Check boxes are now used to select search options instead of shift-based multi-select.

  	Ingest Modules: 
  	- File metadata updates are batched up before being saved to the case database for better performance. 
  	- Parsing of iLEAPP and aLEAPP output was expanded to create communication relationships which can be displayed in the Communications UI. 
  	- EML email parsing handles EML messages that are attachments (and have their own attachments). 
  	- Domain categorization within Recent Activity can be customized by user-defined rules that can be imported and exported.
  	- Account IDs and Installed Applications are added to the Central Repository.
  	- Keyword search can be configured to only do OCR and skip non-OCR files.

  	Miscellaneous:
  	- A “Reset Windows” feature was created to help redock windows. 
  	- A case-insensitive wordlist of all words in the keyword search index can be exported as a text document.
  	- Information from the Data Source Summary panels can be exported as an Excel spreadsheet.
  	- More artifacts are added to the timeline and artifacts with multiple time-based attributes are mapped to multiple timeline events.
  	- Added option to only perform optical character recognition on certain file types.
  	- Heap dumps can be saved to a custom location.
  	- More detailed error messages about encrypted disks when they are added.
  	- Added file size filter to Ingest Filters.

  	Performance:
  	- Keyword search does not make an explicit commit for each report if ingest is running. 
  	- Language ID is performed on a small subset of a file instead of the entire file.
  	- Recent Activity is more efficient because of TSK changes to file searching (using extension).
  	- Embedded file extractor module has been made faster by doing file typing in memory and adding extracted files in batches. 
  	- Moved Content Viewers setNode() and isSupported()/isPreferred() code to background threads. 
  	- Moved Data Source Summary Panel population code to background threads. 
  	- Moved Node/Tree queries to background threads.

  	Bug Fixes:
  	- Fixed embedded file extractor file name escaping bug.
  	- Detect VHD files by signature and not extension.
  	- Fixed iLEAPP path error.
  	- Content viewers UIs are more consistent.
  	- Assorted bug fixes are included.

  	Auto Ingest:
  	- The Auto Ingest Dashboard is resizable.
  	- Get thread dumps from AID
  	- Added beta pause feature that pauses auto ingest for a set amount of time at a scheduled date and time.


author: Lawrence R. Rogers <lrr@cert.org> 4.19.2-1
changelog:
  * Release 4.19.2-1
  	---------------- VERSION 4.19.2  --------------
  	GUI Updates:
  	- Special handling of Interesting Files and Interesting Results analysis results was removed from the tree and they are now shown as individual nodes. 
  	- Updated display of analysis results in the tabular results viewer.
  	- Improved algorithm for populating the S(core) column in the tabular results view.
  	- Updated the right-click menu options for data artifacts and analysis results.
  	- The O(ther Cases) column in the tabular results view and the Other Occurrences content viewer now count cases in the same way.  

  	Misc:
  	- Installed applications are now added to the central repository.
  	- The Central Repository ingest module no longer uses the generic Interesting Item analysis result and instead creates more specific Previously Seen, Previously Unseen, and Previously Notable analysis results.
  	- Automatic destinations (jump lists) parsing added to the Recent Activity module.
  	- French translation of user documentation contributed by github user Seb2lyon.

  	Bug Fixes:
  	- Analysis Results and Annotation content viewers now work when parent is a data artifact.
  	- Fixed bug that prevented media attachments from being displayed in the Communications Viewer. 
  	- Fixed RegRipper bug to support parsing of ShellBags with non-Latin characters.
  	- Assorted GUI responsiveness fixes.
  	- Fixed NTFS handling of compressed files that were not fully initialized (via TSK). 
  	- Other assorted bug fixes.

  	---------------- VERSION 4.19.1  --------------
  	Bug Fixes:
  	- Fixed connection leak associated with creating OS Accounts
  	- Decreased priority of OS Account Content Viewer
  	- Misc bound check fixes in TSK


author: Richard Cordovano <rcordovano@users.sourceforge.net> 7.2.641-1
changelog:
  * Release 7.2.641-1

  	* Log output may be sent to multiple job logs and hash logs. Simply specify
   	  log=LOG and/or hlog=LOG more than once.

   	* Verification of an image restored to a device larger than the image is now
   	  supported. Specify hof=DEVICE to hash only the bytes dc3dd writes to the
   	  device. Specify fhod=DEVICE to hash both the bytes dc3dd writes to the
   	  device and all the bytes that follow, up to the end of the device.   

   	* Specifying hof=DEVICE will now default to phod=DEVICE behavior (hash only 
   	  the bytes output by dc3dd, not the full device).


author: Lawrence R. Rogers <lrr@cert.org> 2.7-1
changelog:
  * Release 2.7-1
    * Ddru_ntfsfindbad 1.5 released:
      + Fixed possible program crash if partition boot sector error
      + Better partition boot sector error output
    * Ddru_ntfsbitmap 1.5 released:
      + Fixed possible program crash if partition boot sector error
      + Better partition boot sector error output


author: Lawrence R. Rogers <lrr@cert.org> 2.8-1
changelog:
  * Release 2.8-1
  	No longer uses automake to compile, now uses a regular make file. No program files were updated or changed.


author: Lawrence R. Rogers <lrr@cert.org> - 1.2.7-1
changelog:
  * Release 1.2.7-1
  	1.2.7 (2017-06-05)
  		* Fixed handling of two last clusters: operations with files that occupy these
  		  clusters could fail.
  		* Fixed crash when started with stdin, stdout or stderr closed.

  	1.2.6 (2017-01-28)
  		* Operations with directories (except initial listing) now make less
  		  read/write system calls.
  		* Fixed handling of files with optional tail entries (0xe0-0xff): videoclip
  		  files created by Sony cameras were missing.
  		* Write operations now correctly return ENOSPC (instead of EIO) when there is
  		  no free disk space left.
  		* Fixed max file name length: it's 255 16-bit code units (not 256).

  	1.2.5 (2016-12-05)
  		* Added an option for dumpexfat to show file fragments [Daniel Drake].
  		* Fixed crash when directory starts with an invalid cluster.
  		* Daylight saving time in now properly reflected in file timestamps.


author: Lawrence R. Rogers <lrr@cert.org> - 1.2.8-1
changelog:
  * Release 1.2.8-1
  	1.2.8 (2018-02-03)
  		* Fixed new files or directories creation in the root directory: ensure there
  		  are no 0x00 entries before valid ones; otherwise Windows can corrupt them.
  		* Fixed compilation on GNU/HURD platform.


author: Lawrence R. Rogers <lrr@cert.org> - 1.3.0-1
changelog:
  * Release 1.3.0-1
  	1.3.0-1 (2018-09-15)
  		* exfatfsck can now repair some errors.
  		* Added experimental Android support for exfat-utils [liminghao, LongPingWEI,
  		  Pablo Mendez Hernandez, Pierre-Hugues Husson].
  		* Cleaned up FUSE code preparing for FUSE 3 support.
  		* Removed OpenBSD support as it does not handle -o option in fuse_main().
  		* Re-introduced FreeBSD support [Oleksii Samorukov].
  		* Fixed DragonFly BSD support [Tomohiro Kusumi].
  		* dirent->d_type in now filled on readdir() [Mark Browning].


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.1
changelog:
  * Release 1.6-1.1
  	This is the initial release of this package.
  	It contains all of the OS and architecture-independent parts of FMEM.


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.2
changelog:
  * Release 1.6-1.2
  	Updated these files:
                  lkm.c
          to be in sync with the FMEM Forensics Source code repository.


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.3
changelog:
  * Release 1.6-1.3
  	Updated these files:
                  lkm.c
          to compile with linux kernels 4.7.


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.4
changelog:
  * Release 1.6-1.4
  	Updated lkm.c to current as of 2019-10-22.
  	Also updated isntall-mem to reference the correct location of the kernel modules.


author: Lawrence R. Rogers <lrr@cert.org> 1.6-13
changelog:
  * Release 1.6-13
          Kernel modules were added for the following kernels:
  		2.6.18-409
  		2.6.18-408


author: Lawrence R. Rogers <lrr@cert.org> 1.6-60
changelog:
  * Release 1.6-60
  	Kernel modules were added for the following kernels:
  		2.6.32-754.24.3
  		2.6.32-754.24.2


author: Lawrence R. Rogers <lrr@cert.org> 1.6-26
changelog:
  * Release 1.6-26
  	Kernel modules added for the following kernels:
  		4.18.0-305.19.1
  		4.18.0-305.17.1


author: Lawrence R. Rogers <lrr@cert.org> 1.6-11
changelog:
  * Release 1.6-11
  	Initial release. Kernel modules were added for the following kernels
  		5.14.0-124
  		5.14.0-127
  		5.14.0-130
  		5.14.0-134
  		5.14.0-142


author: Lawrence R. Rogers <lrr@cert.org> 1.6-14
changelog:
  * Release 1.6-14
  	Kernel modules were added for the following kernels:
  		5.14.0-162
  		5.14.0-163
  		5.14.0-165


author: Lawrence R. Rogers <lrr@cert.org> 1.6-8
changelog:
  * Release 1.6-8
  	Kernel modules were added for the following kernels:
  		5.14.0-115
  		5.14.0-118
  		5.14.0-119
  		5.14.0-120
  		5.14.0-124


author: 2014 Lawrence R. Rogers <lrr@cert.org> 1.6-1
changelog:
  * Release 1.6-1
  	Kernel modules are available for the following kernels:
  		3.3.4-5    3.3.7-1    3.4.0-1    3.4.2-4    3.4.3-1    3.4.4-3
  		3.4.4-5    3.4.5-2    3.4.6-2    3.5.0-2    3.5.1-1    3.5.2-1
  		3.5.2-3    3.5.3-1    3.5.4-1    3.5.4-2    3.5.5-2    3.5.6-1
  		3.6.1-1    3.6.2-4    3.6.3-1    3.6.5-1    3.6.6-1    3.6.7-4
  		3.6.8-2    3.6.9-2    3.6.10-2   3.6.11-1   3.6.11-5   3.7.3-101
  		3.7.6-102  3.7.9-101  3.7.9-104  3.8.3-103  3.8.4-102  3.8.8-100
  		3.8.11-100 3.8.12-100 3.8.13-100 3.9.8-100  3.9.10-100


author: 2014 Lawrence R. Rogers <lrr@cert.org> 1.6-1
changelog:
  * Release 1.6-1
  	Kernel modules are available for the following kernels:
  		3.6.10-4     3.7.4-204   3.7.5-201   3.7.6-201   3.7.7-201
  		3.7.8-202    3.7.9-201   3.7.9-205   3.8.1-201   3.8.2-206
  		3.8.3-201    3.8.3-203   3.8.4-202   3.8.5-201   3.8.6-203
  		3.8.7-201    3.8.8-202   3.8.8-203   3.8.9-200   3.8.11-200
  		3.9.2-200    3.9.4-200   3.9.5-201   3.9.6-200   3.9.9-201
  		3.9.10-200   3.9.11-200  3.10.4-100  3.10.6-100  3.10.7-100
  		3.10.9-100   3.10.10-100 3.10.11-100 3.10.12-100 3.10.13-101
  		3.10.14-100  3.11.4-101  3.11.7-100  3.11.9-100  3.11.10-100


author: Lawrence R. Rogers <lrr@cert.org> 1.6-5
changelog:
  * Release 1.6-5
          Kernel modules are available for the following kernels:
                  3.14.17-100


author: Lawrence R. Rogers <lrr@cert.org> 1.6-6
changelog:
  * Release 1.6-6
          Kernel modules are available for the following kernels:
                  3.14.19-100


author: Lawrence R. Rogers <lrr@cert.org> 1.6-7
changelog:
  * Release 1.6-7
          Kernel modules are available for the following kernels:
                  3.14.22-100


author: Lawrence R. Rogers <lrr@cert.org> 1.6-8
changelog:
  * Release 1.6-8
          Kernel modules are available for the following kernels:
                  3.14.23-100


author: Lawrence R. Rogers <lrr@cert.org> 1.6-10
changelog:
  * Release 1.6-10
          Kernel modules are available for the following kernels:
                  3.14.27-100


author: Lawrence R. Rogers <lrr@cert.org> 1.6-11
changelog:
  * Release 1.6-11
          Kernel modules are available for the following kernels:
                  3.14.27-100 i686


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.38
changelog:
  * Release 1.6-1.38
  	Kernel modules were added for the following kernels:
                  4.10.10-100


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.39
changelog:
  * Release 1.6-1.39
  	Kernel modules were added for the following kernels:
                  4.10.14-100


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.40
changelog:
  * Release 1.6-1.40
  	Kernel modules were added for the following kernels:
                  4.10.15-100
                  4.10.16-100


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.41
changelog:
  * Release 1.6-1.41
  	Kernel modules were added for the following kernels:
                  4.10.17-100


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.42
changelog:
  * Release 1.6-1.42
  	Kernel modules were added for the following kernels:
                  4.11.5-100
                  4.11.4-100


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.46
changelog:
  * Release 1.6-1.46
  	Kernel modules were added for the following kernels:
                  4.11.10-100


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.47
changelog:
  * Release 1.6-1.47
  	Kernel modules were added for the following kernels:
                  4.11.12-100


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.40
changelog:
  * Release 1.6-1.40
  	Kernel modules were added for the following kernels:
  		4.10.15-100
  		4.10.16-100


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.34
changelog:
  * Release 1.6-1.34
  	Kernel modules were added for the following kernels:
  		4.15.16-200
  		4.15.15-200


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.35
changelog:
  * Release 1.6-1.35
  	Kernel modules were added for the following kernels:
  		4.20.17-100
  		4.20.16-100
  		4.20.15-100


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.35
changelog:
  * Release 1.6-1.35
  	Kernel modules were added for the following kernels:
  		5.8.10-100
  		5.8.9-101
  		5.8.8-100


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.37
changelog:
  * Release 1.6-1.37
  	Kernel modules were added for the following kernels:
  		5.10.21-100
  		5.10.20-100


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.40
changelog:
  * Release 1.6-1.40
  	Kernel modules were added for the following kernels:
  		5.11.11-100
  		5.11.10-100


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.41
changelog:
  * Release 1.6-1.41
  	Kernel modules were added for the following kernels:
  		5.11.13-100
  		5.11.12-100


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.42
changelog:
  * Release 1.6-1.42
  	Kernel modules were added for the following kernels:
  		5.11.15-100
  		5.11.14-100


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.45
changelog:
  * Release 1.6-1.45
  	Kernel modules were added for the following kernels:
  		5.11.19-100
  		5.11.18-100


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.46
changelog:
  * Release 1.6-1.46
  	Kernel modules were added for the following kernels:
  		5.11.22-100
  		5.11.21-100


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.39
changelog:
  * Release 1.6-1.39
  	Kernel modules were added for the following kernels:
  		5.13.15-100
  		5.13.14-100


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.40
changelog:
  * Release 1.6-1.40
  	Kernel modules were added for the following kernels:
  		5.13.19-100
  		5.13.16-100


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.43
changelog:
  * Release 1.6-1.43
  	Kernel modules were added for the following kernels:
  		5.14.12-100
  		5.14.11-100


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.45
changelog:
  * Release 1.6-1.45
  	Kernel modules were added for the following kernels:
  		5.14.16-101
  		5.14.15-100


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.46
changelog:
  * Release 1.6-1.46
  	Kernel modules were added for the following kernels:
  		5.14.18-100
  		5.14.17-101


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.45
changelog:
  * Release 1.6-1.45
  	Kernel modules were added for the following kernels:
  		5.16.20-100
  		5.16.19-100


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.50
changelog:
  * Release 1.6-1.50
  	Kernel modules were added for the following kernels:
  		5.17.9-100
  		5.17.8-100

  5.17.7-100


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.34
changelog:
  * Release 1.6-1.34
  	Kernel modules were added for the following kernels:
  		5.18.16-100
  		5.18.15-100


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.41
changelog:
  * Release 1.6-1.41
  	Kernel modules were added for the following kernels:
  		5.19.11-100
  		5.19.10-100


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.10
changelog:
  * Release 1.6-1.10
  	Kernel modules were added for the following kernels:
  		5.18.16-200
  		5.18.15-200


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.17
changelog:
  * Release 1.6-1.17
  	Kernel modules were added for the following kernels:
  		5.19.11-200
  		5.19.10-200


author: Reini Urban <rurban@cpan.org> 9.2-PUBLIC_20201113-1
changelog:
  * Release 9.2-PUBLIC_20201113-1
  	Version 9.2 - see https://www.ghidra-sre.org/releaseNotes_9.2.html for the changelog


author: 2020 Reini Urban <rurban@cpan.org> 9.2.2_PUBLIC_20201229-1
changelog:
  * Release 9.2.2_PUBLIC_20201229-1
  	Version 9.2.2 - see https://www.ghidra-sre.org/releaseNotes_9.2.2.html for the changes


author: Reini Urban <rurban@cpan.org> 10.0.1_PUBLIC_20210708-1
changelog:
  * Release 10.0.1_PUBLIC_20210708
  	Version 10.0.1 - see https://htmlpreview.github.io/?https://github.com/NationalSecurityAgency/ghidra/blob/Ghidra_10.0.1_build/Ghidra/Configurations/Public_Release/src/global/docs/WhatsNew.html for the changes


author: Reini Urban <rurban@cpan.org> 10.0.2_PUBLIC_20210804-1
changelog:
  * Release 10.0.2_PUBLIC_20210804
  	Version 10.0.2 - see https://htmlpreview.github.io/?https://github.com/NationalSecurityAgency/ghidra/blob/Ghidra_10.0.2_build/Ghidra/Configurations/Public_Release/src/global/docs/ChangeHistory.html for the changes


author: Reini Urban <rurban@cpan.org> 10.0.4_PUBLIC_20210928-1
changelog:
  * Release 10.0.4_PUBLIC_20210928
  	Version 10.0.4 - see https://htmlpreview.github.io/?https://github.com/NationalSecurityAgency/ghidra/blob/Ghidra_10.0.4_build/Ghidra/Configurations/Public_Release/src/global/docs/ChangeHistory.html for changes


author: Reini Urban <rurban@cpan.org> 10.1_PUBLIC_20211210-1
changelog:
  * Release 10.1_PUBLIC_20211210-1
  	Version 10.1 - see https://htmlpreview.github.io/?https://github.com/NationalSecurityAgency/ghidra/blob/Ghidra_10.1_build/Ghidra/Configurations/Public_Release/src/global/docs/ChangeHistory.html for changes


author: Reini Urban <rurban@cpan.org> 10.1.1_PUBLIC_20211221-1
changelog:
  * Release 10.1_PUBLIC_20211221-1
  	Version 10.1.1 - see https://htmlpreview.github.io/?https://github.com/NationalSecurityAgency/ghidra/blob/Ghidra_10.1.1_build/Ghidra/Configurations/Public_Release/src/global/docs/WhatsNew.html for changes


author: Reini Urban <rurban@cpan.org> 10.1.1_PUBLIC_20220125-1
changelog:
  * Release 10.1_PUBLIC_20220125-1
  	Version 10.1.2 - see https://htmlpreview.github.io/?https://github.com/NationalSecurityAgency/ghidra/blob/Ghidra_10.1.2_build/Ghidra/Configurations/Public_Release/src/global/docs/ChangeHistory.html for changes.


author: Lawrence R. Rogers <lrr@cert.org> 10.1.5_PUBLIC_20220726-1
changelog:
  * Release 10.1.5_PUBLIC_20220726-1
  	Version 10.1.5 - see https://htmlpreview.github.io/?https://github.com/NationalSecurityAgency/ghidra/blob/Ghidra_10.1.5_build/Ghidra/Configurations/Public_Release/src/global/docs/ChangeHistory.html


author: Lawrence R. Rogers <lrr@cert.org> 0.8.12-1
changelog:
  * Release 0.8.12-1
  	guymager-beta (0.8.12-1) unstable; urgency=low
  	 * Avoiding error "flexible array member ... ~not at end of ..." in newer gcc versions.
           * Removed bug where acquisition state never changed from "Launch" to "Acquire" for special devices


author: Lawrence R. Rogers <lrr@cert.org> 0.8.13-1
changelog:
  * Release 0.8.13-1
  	guymager-beta (0.8.13-1) unstable; urgency=low
  	 * Querying CID data for SD memory cards (DeviceInfoCommands in guymager.cfg)
  	 * String of OS version in corresponding EWF field now corresponds to the
  	   output of "uname -r" in order to circumvent Encase bugs.


author: Lawrence R. Rogers <lrr@@cert.org> - 2021.04.26-1
changelog:
  - Release 2021.04.26-1
  	Features
  		Parse "Site Characteristics Database" LevelDB @@obsidianforensics (#73)
  		Add plugin to run Unfurl across Local Storage values @@obsidianforensics (#77)
  		Add support for Chrome 88 - 90 (#72, #79)
  	Minor Changes & Fixes
  		Update Chrome Extensions parser to work on updated artifact types. @@obsidianforensics (#82)
  		Added additional download interrupt_reason codes. Minor style fixes. @@obsidianforensics (#81)
  		Add more exception handling around LevelDB records in case of corruption @@obsidianforensics (#78)
  		Add check to ensure duration values in Media History are plausible @@obsidianforensics (#75)
  		Fix bug in per_host_zoom_levels parsing @@obsidianforensics (#74)
  		If autofill values are encrypted (as Edge's are), replace the encrypted bytes with a placeholder @@obsidianforensics (#70)
  		Add new visit_source values to Update chrome.py @@chadtilbury (#68)


author: Lawrence R. Rogers <lrr@@cert.org> - 2021.12.16-1
changelog:
  - Release 2021.12.16-1
  	 Features
  		Support for Chrome 91-96 by @obsidianforensics in #107, #117
  		Add parsing of TransportSecurity file (HSTS settings).
  		Add parsing of Session Storage #102
  		Adds new "Site Setting" record type, which includes settings and preferences that are site-specific, including zoom, mute, hsts, engagement, and potentially more. #100
  		More parsing of Preference items: network_prediction_options, password_manager, sessions.event_log, and sync settings. #101
  	Minor Changes & Fixes
  		Fix for case with missing Brave version by @cteodor in #99
  		Update embedded ccl_chromium_indexeddb by @obsidianforensics in #102
  		Timestamp sorting bug caused by incorrectly interpreting microsecond timestamps by @obsidianforensics in #103
  		When searching for Profiles, don't follow symlinks (reports of loops,… by @obsidianforensics in #104
  		Add try/except around reading Session Storage records in case of Leve… by @obsidianforensics in #106
  		Two small quality of life improvements by @kumavis in #111
  		chmod +x hindsight_gui.py by @kumavis in #112
  		Report analysis session error by @kumavis in #113
  		Add support for new Network subdirectory and files moved within it by @obsidianforensics in #116
  	Packaging changes
  		This version now builds the virtual environment at package building time, not at package installation time.


author: Lawrence R. Rogers <lrr@cert.org> 20181227-5
changelog:
  * Release 20181227-5
  	Version from 20181227-5: Uses python3_pkgversion for the current version of Python 3.


author: Lawrence R. Rogers <lrr@cert.org> 20181128-4
changelog:
  * Release 20181128-4
  	Version 20181128-4: Uses python3_pkgversion for the current version of Python 3.


author: Lawrence R. Rogers <lrr@cert.org> 2.3.0-1
changelog:
  * Release 2.3.0-1
  	Added the ipfixDump application which used to be included with YAF, and made many changes to the application.
  	  Use configure --disable-tools to prevent building and installing ipfixDump.
  	Fixed bugs in reading and writing information elements whose type was list and elementId was a value other than 291, 292, or 293.
  	Information element type information and exporting template metadata.


author: Lawrence R. Rogers <lrr@cert.org> 2.3.1-1
changelog:
  * Release 2.3.1-1
  	Fixed a double-freeing of memory and memory leaks in some of the error handling code.


author: Lawrence R. Rogers <lrr@cert.org> 2.4.0-1
changelog:
  * Release 2.4.0-1
  	Enhanced the output of ipfixDump by
  		(1) including the template's name with its list of elements
  		(2) adding the templates' names to the stats output
  		(3) marking scope elements in templates and their corresponding values in data records, and
  		(4) including the name for list semantics.
  	Fixed an issue in the libfixbuf.spec.in file, and removed the generated libfixbuf.spec file from the distribution.
  	Changed how the information model handles the re-insertion an existing element to reuse the existing element instead of using new memory.
  	Added stricter checking of the elements lengths' specified in a template.
  	  Currently a log message is written for an invalid length; in the future, this may cause the template to be rejected.


author: Lawrence R. Rogers <lrr@cert.org> 2.4.1-1
changelog:
  * Release 2.4.1-1
  	Added support for OpenSSL 1.1.0 and removed support for versions prior to 1.0.2.
  	Updated CERT IPFIX elements.


author: Lawrence R. Rogers <lrr@cert.org> 20181227-4
changelog:
  * Release 20181227-4
  	Version 20181227-4: Uses python3_pkgversion for the current version of Python 3.


author: Lawrence R. Rogers <lrr@cert.org> 2.0.5-1
changelog:
  * Release 2.0.5-1
  	libguytools2 (2.0.5-1) unstable; urgency=low
  	  * Moved to Qt5
  	  * Adapted to Debian 8 (Jessie)
  	 -- Guy Voncken <develop@faert.net>  Tue, 18 Jul 2017 12:00:00 +0200


author: Lawrence R. Rogers <lrr@cert.org> 2.1.0-1
changelog:
  * Release 2.1.0-1
  	libguytools2 (2.1.0-1) unstable; urgency=low
  	 * Cleaned up for C++14, some minor prototype changes to ensure same bit widths on different architectures
  	 * Some debugging (handling user errors in configuration files)
  	 * Understands # at beginning of line (first non-blank char) for remarks (REM still remains valid)
  	 -- Guy Voncken <develop@faert.net>  Fri, 31 Aug 2018 16:00:00 +0200


author: Lawrence R. Rogers <lrr@cert.org> 1.14-3
changelog:
  New in 1.15:
  	* The UTF-8 converter now rejects surrogates and out-of-range code points.
  	* Added ISO-2022-JP-MS converter.
  	* Updated the CP1255 converter to map one more character.
  	* The functions now support strings longer than 2 GB.


author: Lawrence R. Rogers <lrr@cert.org> 20181231-4
changelog:
  * Release 20181231-4
  	Version 20181231-4: Uses python3_pkgversion for the current version of Python 3.


author: Lawrence R. Rogers <lrr@cert.org> 20180714-3
changelog:
  * Release 20180714-3
  	Release 3 - Removed conflicts when that arise when python2 and python3
  		    versions are attempted to be installed on a system.
  		   Also, -python packages renamed to -python2.


author: Carl Byington <carl@five-ten-sg.com> 0.6.76-1
changelog:
  - Stuart C. Naifeh - fix rfc2231 encoding when saving messages to
    both .eml and .msg formats.
  - fix template issue to build with gcc 11


author: Lawrence R. Rogers <lrr@cert.org> 20181227-5
changelog:
  * Release 20181227-5
  	Version 20181227-5: Uses python3_pkgversion for the current version of Python 3.


author: Lawrence R. Rogers <lrr@cert.org> 20190315-3
changelog:
  * Release 20190315-3
  	Version 20190315-3: Uses python3_pkgversion for the current version of Python 3.


author: Simone Caronni <negativo17@gmail.com> - 1.18-2.20170915git0ceb1c1
changelog:
  - Update to latest snapshot post rc3.
  - Remove RHEL 6 support.
  - Clean up SPEC file.
  - Trim changelog.


author: Lawrence R. Rogers <lrr@cert.org> 0.2.5-3
changelog:
  * Release 0.2.5-3
  	Made links so that the tools, documentation, header files, and libraries have an alias of vmfs5.

  - Remove redundant tags/sections from specfile


author: Lawrence R. Rogers <lrr@cert.org> 20181203-4
changelog:
  * Release 20181203-4
  	Version 20181203-4: Uses python3_pkgversion for the current version of Python 3.


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-6
changelog:
  * Release 1.1.r17-6
  	Updated
  		* disk.c - added O_SYNC for output files
  		* main.c - bug fix
  		* tcp.c - support for 5.8 kernels


author: Lawrence R. Rogers <lrr@cert.org> 1.9.1-7
changelog:
  * Release 1.9.1-7
  	Changed version to match LiME web site version
  	Updated
  		* disk.c - Fixed to remove get_fs/set_fs in kernel 5.10 and beyond 
  		* tcp.c  - Fixed to remove get_fs/set_fs in kernel 5.10 and beyond


author: Lawrence R. Rogers <lrr@cert.org> 1.6-11
changelog:
  * Release 1.6-11
          Kernel modules were added for the following kernels:
                  2.6.18-406


author: Lawrence R. Rogers <lrr@cert.org> 1.6-12
changelog:
  * Release 1.6-12
          Kernel modules were added for the following kernels:
                  2.6.18-407


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-60
changelog:
  * Release 1.1.r17-60
  	Kernel modules were added for the following kernels:
  		2.6.32-754.24.3
  		2.6.32-754.24.2


author: Lawrence R. Rogers <lrr@cert.org> 1.9.1-26
changelog:
  * Release 1.9.1-26
  	Kernel modules were added for the following kernels:
  		4.18.0-305.19.1
  		4.18.0-305.17.1


author: Lawrence R. Rogers <lrr@cert.org> 1.9.1-11
changelog:
  * Release 1.9.1-11
  	Initial release. Kernel modules were added for the following kernels:
  		5.14.0-124
  		5.14.0-127
  		5.14.0-130
  		5.14.0-134
  		5.14.0-142


author: Lawrence R. Rogers <lrr@cert.org> 1.9.1-14
changelog:
  * Release 1.9.1-14
  	Kernel modules were added for the following kernels:
  		5.14.0-162
  		5.14.0-163
  		5.14.0-165


author: Lawrence R. Rogers <lrr@cert.org> 1.9.1-8
changelog:
  * Release 1.9.1-8
          Kernel modules were added for the following kernels:
  		5.14.0-115
  		5.14.0-118
  		5.14.0-119
  		5.14.0-120
  		5.14.0-124


author: Lawrence R. Rogers <lrr@cert.org> 1.9.1-9
changelog:
  * Release 1.9.1-9
          Kernel modules were added for the following kernels:
  		5.14.0-127
  		5.14.0-130


author: Lawrence R. Rogers <lrr@cert.org> 1.9.1-12
changelog:
  * Release 1.9.1-12
          Kernel modules were added for the following kernels:
  		5.14.0-145
  		5.14.0-148


author: Lawrence R. Rogers <lrr@cert.org> 1.9.1-14
changelog:
  * Release 1.9.1-14
          Kernel modules were added for the following kernels:
  		5.14.0-162
  		5.14.0-163
  		5.14.0-165


author: 2014 Lawrence R. Rogers <lrr@cert.org> 1.1.r17-1
changelog:
  * Release 1.1.r17-1
  	Kernel modules are available for the following kernels:
  		3.3.4-5    3.3.7-1    3.4.0-1    3.4.2-4    3.4.3-1    3.4.4-3
  		3.4.4-5    3.4.5-2    3.4.6-2    3.5.0-2    3.5.1-1    3.5.2-1
  		3.5.2-3    3.5.3-1    3.5.4-1    3.5.4-2    3.5.5-2    3.5.6-1
  		3.6.1-1    3.6.2-4    3.6.3-1    3.6.5-1    3.6.6-1    3.6.7-4
  		3.6.8-2    3.6.9-2    3.6.10-2   3.6.11-1   3.6.11-5   3.7.3-101
  		3.7.6-102  3.7.9-101  3.7.9-104  3.8.3-103  3.8.4-102  3.8.8-100
  		3.8.11-100 3.8.12-100 3.8.13-100 3.9.8-100  3.9.10-100


author: 2014 Lawrence R. Rogers <lrr@cert.org> 1.1.r17-1
changelog:
  * Release 1.1.r17-1
  	Kernel modules are available for the following kernels:
  		3.6.10-4     3.7.4-204   3.7.5-201   3.7.6-201   3.7.7-201
  		3.7.8-202    3.7.9-201   3.7.9-205   3.8.1-201   3.8.2-206
  		3.8.3-201    3.8.3-203   3.8.4-202   3.8.5-201   3.8.6-203
  		3.8.7-201    3.8.8-202   3.8.8-203   3.8.9-200   3.8.11-200
  		3.9.2-200    3.9.4-200   3.9.5-201   3.9.6-200   3.9.9-201
  		3.9.10-200   3.9.11-200  3.10.4-100  3.10.6-100  3.10.7-100
  		3.10.9-100   3.10.10-100 3.10.11-100 3.10.12-100 3.10.13-101
  		3.10.14-100  3.11.4-101  3.11.7-100  3.11.9-100  3.11.10-100


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-2
changelog:
  * Release 1.1.r17-2
  	Kernel modules are available for the following kernels:
  		3.14.7-100
  		3.14.8-100


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-5
changelog:
  * Release 1.1.r17-5
          Kernel modules are available for the following kernels:
                  3.14.17-100


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-6
changelog:
  * Release 1.1.r17-6
          Kernel modules are available for the following kernels:
                  3.14.19-100


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-7
changelog:
  * Release 1.1.r17-7
          Kernel modules are available for the following kernels:
                  3.14.22-100


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-8
changelog:
  * Release 1.1.r17-8
          Kernel modules are available for the following kernels:
                  3.14.23-100


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-10
changelog:
  * Release 1.1.r17-10
          Kernel modules are available for the following kernels:
                  3.14.27-100


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-11
changelog:
  * Release 1.1.r17-11
          Kernel modules are available for the following kernels:
                  3.14.27-100 i686


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-27
changelog:
  * Release 1.1.r17-27
  	Initial release. Kernel modules were added for the following kernels:
  		4.7.4-100


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-28
changelog:
  * Release 1.1.r17-28
  	Initial release. Kernel modules were added for the following kernels:
  		4.7.5-100


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-29
changelog:
  * Release 1.1.r17-29
  	Initial release. Kernel modules were added for the following kernels:
  		4.7.6-100


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-30
changelog:
  * Release 1.1.r17-30
  	Initial release. Kernel modules were added for the following kernels:
  		4.7.7-100


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-31
changelog:
  * Release 1.1.r17-31
  	Initial release. Kernel modules were added for the following kernels:
  		4.7.8-100
  		4.7.9-100


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-32
changelog:
  * Release 1.1.r17-32
  	Initial release. Kernel modules were added for the following kernels:
  		4.7.10-100


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-33
changelog:
  * Release 1.1.r17-33
  	Initial release. Kernel modules were added for the following kernels:
  		4.8.10-100
  		4.8.8-100


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-34
changelog:
  * Release 1.1.r17-34
  	Initial release. Kernel modules were added for the following kernels:
  		4.8.11-100


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-35
changelog:
  * Release 1.1.r17-35
  	Initial release. Kernel modules were added for the following kernels:
  		4.8.12-100


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-36
changelog:
  * Release 1.1.r17-36
  	Initial release. Kernel modules were added for the following kernels:
  		4.8.13-100


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-38
changelog:
  * Release 1.1.r17-38
  	Kernel modules were added for the following kernels:
                  4.10.10-100


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-39
changelog:
  * Release 1.1.r17-39
  	Kernel modules were added for the following kernels:
                  4.10.14-100


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-40
changelog:
  * Release 1.1.r17-40
  	Kernel modules were added for the following kernels:
                  4.10.15-100
                  4.10.16-100


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-41
changelog:
  * Release 1.1.r17-41
  	Kernel modules were added for the following kernels:
                  4.10.17-100


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-42
changelog:
  * Release 1.1.r17-42
  	Kernel modules were added for the following kernels:
                  4.11.5-100
                  4.11.4-100


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-43
changelog:
  * Release 1.1.r17-43
  	Kernel modules were added for the following kernels:
                  4.11.6-101


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-44
changelog:
  * Release 1.1.r17-44
  	Kernel modules were added for the following kernels:
                  4.11.8-100


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-45
changelog:
  * Release 1.1.r17-45
  	Kernel modules were added for the following kernels:
                  4.11.9-100


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-46
changelog:
  * Release 1.1.r17-46
  	Kernel modules were added for the following kernels:
                  4.11.10-100


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-47
changelog:
  * Release 1.1.r17-47
  	Kernel modules were added for the following kernels:
                  4.11.12-100


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-40
changelog:
  * Release 1.1.r17-40
  	Kernel modules were added for the following kernels:
  		4.10.15-100
  		4.10.16-100


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-42
changelog:
  * Release 1.1.r17-42
  	Kernel modules were added for the following kernels:
  		4.11.5-100
  		4.11.4-100


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-44
changelog:
  * Release 1.1.r17-44
  	Kernel modules were added for the following kernels:
  		4.13.8-100
  		4.13.10-100


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-31
changelog:
  * Release 1.1.r17-31
  	Kernel modules were added for the following kernels:
  		4.15.10-200
  		4.15.9-200


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-34
changelog:
  * Release 1.1.r17-34
  	Kernel modules were added for the following kernels:
  		4.15.16-200
  		4.15.15-200


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-37
changelog:
  * Release 1.1.r17-37
  	Kernel modules were added for the following kernels:
  		4.18.10-100
  		4.18.9-100


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-37
changelog:
  * Release 1.1.r17-37
  	Kernel modules were added for the following kernels:
  		4.18.9-100
  		4.18.10-100


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-35
changelog:
  * Release 1.1.r17-35
  	Kernel modules were added for the following kernels:
  		4.20.17-100
  		4.20.16-100
  		4.20.15-100


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-40
changelog:
  * Release 1.1.r17-40
  	Kernel modules were added for the following kernels:
  		5.0.13-100
  		5.0.11-100


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-29
changelog:
  * Release 1.1.r17-29
  	Kernel modules were added for the following kernels:
  		5.1.20-200
  		5.1.18-200


author: Lawrence R. Rogers <lrr@cert.org> 1.9.1-37
changelog:
  * Release 1.9.1-37
  	Kernel modules were added for the following kernels:
  		5.10.21-100
  		5.10.20-100


author: Lawrence R. Rogers <lrr@cert.org> 1.9.1-40
changelog:
  * Release 1.9.1-40
  	Kernel modules were added for the following kernels:
  		5.11.11-100
  		5.11.10-100


author: Lawrence R. Rogers <lrr@cert.org> 1.9.1-41
changelog:
  * Release 1.9.1-41
  	Kernel modules were added for the following kernels:
  		5.11.13-100
  		5.11.12-100


author: Lawrence R. Rogers <lrr@cert.org> 1.9.1-42
changelog:
  * Release 1.9.1-42
  	Kernel modules were added for the following kernels:
  		5.11.15-100
  		5.11.14-100


author: Lawrence R. Rogers <lrr@cert.org> 1.9.1-45
changelog:
  * Release 1.9.1-45
  	Kernel modules were added for the following kernels:
  		5.11.19-100
  		5.11.18-100


author: Lawrence R. Rogers <lrr@cert.org> 1.9.1-46
changelog:
  * Release 1.9.1-46
  	Kernel modules were added for the following kernels:
  		5.11.22-100
  		5.11.21-100


author: Lawrence R. Rogers <lrr@cert.org> 1.9.1-39
changelog:
  * Release 1.9.1-39
  	Kernel modules were added for the following kernels:
  		5.13.15-100
  		5.13.14-100


author: Lawrence R. Rogers <lrr@cert.org> 1.9.1-40
changelog:
  * Release 1.9.1-40
  	Kernel modules were added for the following kernels:
  		5.13.19-100
  		5.13.16-100


author: Lawrence R. Rogers <lrr@cert.org> 1.9.1-43
changelog:
  * Release 1.9.1-43
  	Kernel modules were added for the following kernels:
  		5.14.12-100
  		5.14.11-100


author: Lawrence R. Rogers <lrr@cert.org> 1.9.1-45
changelog:
  * Release 1.9.1-45
  	Kernel modules were added for the following kernels:
  		5.14.16-101
  		5.14.15-100


author: Lawrence R. Rogers <lrr@cert.org> 1.9.1-46
changelog:
  * Release 1.9.1-46
  	Kernel modules were added for the following kernels:
  		5.14.18-100
  		5.14.17-101


author: Lawrence R. Rogers <lrr@cert.org> 1.9.1-34
changelog:
  * Release 1.9.1-34
  	Kernel modules were added for the following kernels:
  		5.18.16-100
  		5.18.15-100


author: Lawrence R. Rogers <lrr@cert.org> 1.9.1-41
changelog:
  * Release 1.9.1-41
  	Kernel modules were added for the following kernels:
  		5.19.11-100
  		5.19.10-100


author: Lawrence R. Rogers <lrr@cert.org> 1.9.1-10
changelog:
  * Release 1.9.1-10
  	Kernel modules were added for the following kernels:
  		5.18.16-200
  		5.18.15-200


author: Lawrence R. Rogers <lrr@cert.org> 1.9.1-17
changelog:
  * Release 1.9.1-17
  	Kernel modules were added for the following kernels:
  		5.19.11-200
  		5.19.10-200


author: Jesse Kornblum <research@jessekornblum.com>
changelog:
  * Fixed basic MZ check to work on little endian systems

  	* Removed fcntl.h from configuration

  	* Fixed typo in man page


author: Jesse Kornblum <research@jessekornblum.com>
changelog:
  * Increased buffer size to 8KB to prevent underreads

  	* Added allowed executable extensions:
  	  cpl, hxs, hxi, olb, rll, and tlb.


author: Jesse Kornblum <research@jessekornblum.com>
changelog:
  * Started conversion to allow Unicode filenames, not
  	  finished yet
  	
  	* Moved previous ChangeLog file to NEWS
  	
  	* Fixed potentially fatal error in main.c that called,
  	  ironically enough, fatal_error().

  	* Added counting of number of files processed for displaying
  	  current filename being processed


author: Jesse Kornblum <research@jessekornblum.com>
changelog:
  * Completed conversion to allow Unicode filenames.
  	  Copied a few more functions from the md5deep project.

  	* Checked code into Subversion repository

  	* Version bump to 0.9 in preparation for release

  	* Cast VERBOSE_DISPLAY_NUM to uint64_t in usage message to avoid
  	  crash on OS X.

  	* Added $Id: missidentify.spec,v 1.1 2011/03/04 17:43:17 repoman Exp repoman $ tags to source code


author: Jesse Kornblum <research@jessekornblum.com>
changelog:
  * Fixed illegal filename error handling to use Unicode
  	  error display function.

  	* Updated packaging and README file
  	
  	* Version bump to 1.0


author: Neal Gompa <ngompa13@gmail.com> - 1.1.24-1
changelog:
  - Update to 1.1.24
  - Clean out conditionals referring to obsolete Fedora versions
  - Verify sources with GPG


author: Neal Gompa <ngompa13@gmail.com> - 1.2.0-1
changelog:
  - Rebase to 1.2.0
  - Add patch to support PIE with static linking
  - Remove obsolete Group tags
  - Fix musl library locations and broken sonames
  - Update URL and Source URLs
  - Add filesystem subpackage for install directories


author: Neal Gompa <ngompa@datto.com> - 2:2021.8.22-1
changelog:
  - Rebase to version 2021.8.22 to fix various CVEs (RHBZ#1999869)
  - Clean up old cruft for RHEL < 7
  - Split libraries out to libs subpackage


author: Andreas Schuster <impressum@forensikblog.de> 1.1.0-1
changelog:
  * Release 1.1.0
      * Event.pm: Bumped version to 1.1.0
      * Node0x01.pm, Node0x06: Fixed check for flags
      * Node0x05.pm: Added support for flag 0x40
      * Node0x07.pm: Added parser for XML CDATA section
      * Node0x09.pm: Added parser for XML entity reference
      * Node0x0a.pm, Node0x0b.pm: Added parser for XML processing instruction
      * BXmlNode.pm: Now prints context in case of unknown opcode
      * Type0x09.pm, Type0x0a.pm: Fixed sign error
      * Type0x0b.pm, Type0x0c.pm: Output now in scientific format
      * Type0x83.pm: Added parser for array of signed byte
      * Type0x84.pm: Added parser for array of unsigned byte
      * Type0x85.pm: Added parser for array of signed int16
      * Type0x86.pm: Added parser for array of unsigned int16
      * Type0x87.pm: Added parser for array of signed int32
      * Type0x88.pm: Added parser for array of unsigned int32
      * Type0x89.pm: Added parser for array of signed int64
      * Type0x8a.pm: Added parser for array of unsigned int64
      * Type0x8b.pm: Added parser for array of single prec. float
      * Type0x8c.pm: Added parser for array of double prec. float
      * Type0x8f.pm: Added parser for array of GUID
      * Type0x91.pm: Added parser for array of FILETIME
      * Type0x92.pm: Added parser for array of SYSTEMTIME
      * VariantType.pm: Added the afore mentioned array data types


author: Andreas Schuster <impressum@forensikblog.de> 1.1.1-1
changelog:
  * Release 1.1.1
      * evtxdump.pl: make STDOUT hot/unbuffered
      * Fixed a memory leak caused by a circular object reference. Thanks
        to Heinz Mueller for reporting the bug.
      * evtxdump.pl, evtxinfo.pl, evtxtemplates.pl: require IO::File version 1.14 or later.


author: Lawrence R. Rogers <lrr@cert.org> 1.0-3
changelog:
  * Release 1.0-3
  	Release 3 includes patches from Harlan Carvey for RegRipper 3.0 put into a different location as per his email.


author: Lawrence R. Rogers <lrr@cert.org> 20211024-2
changelog:
  * Release 20211024-2
  	Version from 20211024
  	Release 2 build Plaso in a virtual environment for CentOS/RHEL. The Fedora version is unchanged.


author: PLD Team <feedback@pld-linux.org>
changelog:
  All persons listed below can be reached at <cvs_login>@pld-linux.org

  Revision 1.9 
  Revision 1.9  2005/08/04 13:38:37  adamg
  - fixed remote execution of arbitrary code vulnerability (Secunia Advisory
    SA16183)
  - unbroke %changelog
  - release 2

  Revision 1.8  2005/08/02 18:43:45  djurban
  - update pstotext to ghostgum's (libgs API author) version:

   * Changelog since 1.8g
   Version 1.9 is a modification of 1.8h to recognise excessive space in
    "ashow" as being a word separator, as found output from groff 1.08.
    Also fixed widthshow, awidthshow and added xshow, yshow and xyshow.
    Uses ANSI prototypes.  These are now required, not optional.
    Fixes a number of compiler warnings.
    Note that neither of the original authors still work at DEC/Compaq/HP.
   2004-01-09 by Russell Lang at Ghostgum Software Pty Ltd.

   Version 1.8h is a modification of the original 1.8 to allow
    operation with Aladdin Ghostscript 6.0, to add -output to
    Windows and OS/2 executables, and to insert line breaks
    and form feeds is pstotext output.  Modifications made
   2000-07-15 by Russell Lang at Ghostgum Software Pty Ltd.

    main.c changed to use mkstemp not tempnam for Unix,
   2000-06-02 by Russell Lang at Ghostgum Software Pty Ltd.

  Revision 1.7  2005/07/31 16:17:31  glen
  - todo security

  Revision 1.6  2004/04/10 23:10:21  qboosh
  - updated URLs, replaced "302 Found" html file by proper sources

  Revision 1.5  2004/04/10 23:01:04  qboosh
  - cosmetics, release 2 for Ac

  Revision 1.4  2003/05/28 13:01:25  malekith
  - massive attack: source-md5

  Revision 1.3  2003/05/25 06:25:54  misi3k
  - massive attack s/pld.org.pl/pld-linux.org/

  Revision 1.2  2002/11/29 22:46:07  ankry
  - massive attack: new %doc

  Revision 1.1  2002/03/06 00:08:27  qboosh
  - new: spec based on old RH-contrib package, but uptated to 1.8g
    (unfortunately, there is no version information in Source URL)


author: Robert Scheck <robert@fedoraproject.org> - 0.56-3
changelog:
  - Weak Python 2.7 pyparsing requirement for EPEL 7 correctly
  - Add simple self-test mechanism to detect future weaking mistakes


author: Iryna Shcherbina <ishcherb@redhat.com> - 2.5.1-14
changelog:
  - Update Python 2 dependency declarations to new packaging standards
    (See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)


author: Peter Robinson <pbrobinson@fedoraproject.org> 2.9.45-2
changelog:
  - Add python2 build deps to conditional
  - Re-enable python2 builds on rawhide as it's still a build requirement


author: Lawrence R. Rogers <lrr@cert.org> 0.9.0-1
changelog:
  * Release 0.9.0-1
  	Added compatibility for fixbuf-3.0; pyfixbuf supports fixbuf-2.2 and later.
  	The pyfixbuf module no longer imports the YAF_LIST variables from pyfixbuf.yaflists. Users must explicitly import those variables.
  	Updated the documentation, included programs, and cert_ipfix.xml file to use the same CERT Information Element names as YAF 3.0.0.
  	  Note that the element names defined by the pyfixbuf.yaflists module have not changed.
  	Fixed several bugs.
  	Enhanced documentation and self-tests.


author: Dan Čermák <dan.cermak@cgc-instruments.com> - 0.7.1-5
changelog:
  - BuildRequire python3-setuptools besides python3-devel
    (see https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/GCPGM34ZGEOVUHSBGZTRYR5XKHTIJ3T7/)


author: Larence R. Rogers <lrr@cert,org> - 5.3.0-1
changelog:
  * Release 5.3.0-1
    1. Directory wildcards are allowed in RAR command line in file names to
        archive. For example:

        rar a backup c:\backup\2015*\*

        Recursion is enabled automatically for such directory wildcards
        even if -r switch is not specified.

     2. New 'R' object for -sc switch defines encoding of console
        RAR messages sent to redirected files and pipes. For example:

        rar lb -scur data > list.txt

        will produce Unicode list.txt with archived file names.

     3. Console RAR "l" and "v" commands display file time in YYYY-MM-DD
        format.

     4. "Test" command also verifies contents of NTFS alternate data streams
        in RAR 3.x - 5.x archives. Previously their contents was checked
        only during extraction command.

     5. Bugs fixed:

        a) console RAR crashed instead of displaying an overwrite prompt
           when attempting to add files to already existing volumes;

        b) console RAR "lt" command did not display seconds in file timestamp.


author: Stef Walter <stef@memberwebs.com> 0.8.5
changelog:
  - Ported to Linux/FreeBSD
   - Support for very fragmented MFTs
   - Fixed memory leaks
   - Fixed many bugs


author: Stef Walter <stef@memberwebs.com> 0.8.6
changelog:
  - Don't exit on error reading source drive [Marius Hillenbrand]
   - Fixed core dump when attribute list, but no MFT loaded [Marius Hillenbrand]


author: Stef Walter <stef@memberwebs.com> 0.8.7
changelog:
  - Fix crasher on corrupted drives. A problem with update 
     sequence offset being filled with garbage [Albert Kwok]


author: Lawrence R. Rogers <lrr@cert.org> 3.19.1-1/2
changelog:
  * Release 3.19.1-1/2
  	Add the SilkFile.skip() method to PySiLK.
  	Fix PySiLK compatiblity with Python 3.7 and 3.8.
  	Fix a compilation error when building SiLK without libfixbuf.


author: Lawrence R. Rogers <lrr@cert.org> 3.19.2-1/2
changelog:
  * Release 3.19.2-1/2
  	PySiLK
  		Fix compatibility with Python 3.9 and later.
  	Building
  		Add support for libfixbuf-3.0.0 (v1.7.0 and later are supported).
  		When building with static packing-logic, include the appropriate configure flag in the generated silk.spec file.


author: Lawrence R. Rogers <lrr@cert.org> - 3.15.0-1
changelog:
  * Release 3.15.0-1
  	libskipset changes
  		Add a second argument to skOptionsIPFormatRegister().
  		Remove functions that operate on an IPset Header Entry.
  		Fix a potential bug in skIPSetWrite() by ensuring that the IPset file's header is set to use native byte order.
  	rwsetcat
  		Add the --output-path switch to specify the output file.
  		Do not use the the pager when the output contains only the count of the number of IPs in a singe IPset.


author: Lawrence R. Rogers <lrr@cert.org> - 3.16.0-1
changelog:
  * Release 3.16.0-1
  	libskipset changes
  		Internal changes
  	rwsetbuild, rwsetcat, rwsetmember, rwsettool
  		Enhance the manual pages.


author: Lawrence R. Rogers <lrr@cert.org> - 3.17.0-1
changelog:
  * Release 3.17.0-1
  	rwsetcat
  		POTENTIAL INCOMPATIBILITY. Default to using the IPv4 format for IPv6-addresses in the ::ffff:0:0/96 netblock.
  		Add new values to the --ip-format switch and change how some values (zero-padded) work.
  	libskipset changes
  		Add new values to skipaddr_flags_t.
  		Add function skipaddrStringMaxlen() to compute column width.
  		Mark the num2dot0() and num2dot0_r() functions as deprecated.
  		Do not export the structures used by SiLK header entries.


author: Lawrence R. Rogers <lrr@cert.org> - 3.18.0-1
changelog:
  * Release 3.18.0-1
  	rwsetcat
  		When --ip-format includes zero-padded and CIDR prefixes are being printed, also apply zero-padding to the prefix.
  		Fix a bug when using --ip-format=decimal,zero-padded that caused an extra leading 0 to appear for IPv6 addresses.
  	libskipset changes
  		Add function skipaddrCidrString() to get a string representation of an IP address and its CIDR designation.
  		Add function skipaddrCidrStringMaxlen() to compute column width.
  		Add macro SKIPADDR_CIDR_STRLEN for defining minimum buffer size.


author: Lawrence R. Rogers <lrr@cert.org) 4.10.0-1.1
changelog:
  - Release 4.10.0-1.1
  	C/C++:
  	 - Removed PostgreSQL code (that was used only by Java code)
  	 - Added Java callback support so that database inserts are done in Java.
  	Java:
  	 - Added methods and callbacks as required to allow database population to happen in Java instead of C/C++.
  	 - Added support to allow Autopsy streaming ingest where files are added in batches.
  	 - Added TaggingManager class and concept of a TagSet to support ProjectVic categories.
  	 - Fixed changes to normalization and validation of emails and phone numbers.
  	 - Added a CASE/UCO JAR file that creates JSON-LD based on TSK objects.


author: Lawrence R. Rogers <lrr@cert.org) 4.10.1-1.1
changelog:
  - Release 4.10.1-1.1
  	C/C++:
  	 - Changed Windows build to use Nuget for libewf, libvmdk, libvhdi.
  	 - Fixed compiler warnings
  	 - Clarrified licenses and added Apache license to distribution
  	 - Improved error handling for out of memory issues
  	 - Rejistry++ memory leak fixes
  	Java:
  	 - Localized for Japanese


author: Lawrence R. Rogers <lrr@cert.org) 4.10.2-1.1
changelog:
  - Release 4.10.2-1.1
  	C/C++:
  	 - Added support for Ext4 inline data
  	Java:
  	 - New Blackboard Artifacts for ALEAPP/ILEAPP, Yara, Geo Area, etc.
  	 - Upgraded to PostgreSQL JDBC Driver 42.2.18
  	 - Added SHA256 to files table in DB and added utility calculation methods.
  	 - Changed TimelineManager to make events for any artifact with a time stamp
  	 - Added Japanese translations
  	 - Fixed sychronization bug in getUniquePath


author: Lawrence R. Rogers <lrr@cert.org) 4.11.0-1.1
changelog:
  - Release 4.11.0-1.1
  	C/C++:
  	 - Added checks at various layers to detect encrypted file systems and disks to give more useful error messages.
  	 - Added checks to detect file formats that are not supported (such as AD1, ZIP, etc.) to give more useful error messages.
  	 - Added tsk_imageinfo tool that detects if an image is supported by TSK and if it is encrypted.
  	 - Add numerous bound checks from @joachimmetz
  	 - Clarified licenses as pointed out by @joachimmetz
  	Java:
  	 - Updated from Schema 8.6 to 9.1.
  	 - Added tables and classes for OS Accounts and Realms (Domains).
  	 - Added tables and classes for Host Addresses (IP, MAC, etc.).
  	 - Added tables and classes for Analysis Results vs Data Artifacts by adding onto BlackboardArtifacts.
  	 - Added tables and classes for Host and Person to make it easier to group data sources.
  	 - Added static types for standard artifact types.
  	 - Added File Attribute table to allow custom information to be stored for each file.
  	 - Made ordering of getting lock and connection consistent.
  	 - Made the findFile methods more efficient by using extension (which is indexed).


author: Lawrence R. Rogers <lrr@cert.org) 4.11.1-1.1
changelog:
  - Release 4.11.1-1.1
  	C/C++:
  	 - Several fixes from Joachim Metz
  	 - NTFS Decompression bug fix from Kim Stone and Joel Uckelman
  	Java:
  	 - Fixed connection leak when making OS Accounts in bridge
  	 - OsAccount updates for instance types and special Windows SIDs
  	 - Fixed issue with duplicate value in Japanese timeline translation


author: Lawrence R. Rogers <lrr@cert.org) 4.11.1-2.1
changelog:
  - Release 4.11.1-2.1
  	Built with Java support. Release number is greater than the release for Fedora 36.


author: Lawrence R. Rogers <lrr@cert.org> 0.3.0-1
changelog:
  * Release 0.3.0-1
  	ZeroMQ 3.x compatibility (no longer compatible with ZeroMQ 2.x)
  	protobuf-c 1.0 compatibility (no longer compatible with protobuf-c 0.x)
  	IPv6 address field support
  	Bug fixes


author: Lawrence R. Rogers <lrr@cert.org> 3.1.21.0-1
changelog:
  - Release 3.1.21.0-1
  	See https://blog.snort.org/2022/02/snort-31210-is-now-available-plus-bonus.html


author: Lawrence R. Rogers <lrr@cert.org> 3.1.27.0-1
changelog:
  - Release 3.1.27.0-1
  	See https://github.com/snort3/snort3/releases/tag/3.1.40.0 for a list of changes


author: Lawrence R. Rogers <lrr@cert.org> 3.1.30.0-1
changelog:
  - Release 3.1.30.0-1
  	See https://github.com/snort3/snort3/releases/tag/3.1.30.0 for a list of changes


author: Lawrence R. Rogers <lrr@cert.org> 3.1.31.0-1
changelog:
  - Release 3.1.31.0-1
  	See https://github.com/snort3/snort3/releases/tag/3.1.31.0 for a list of changes


author: Lawrence R. Rogers <lrr@cert.org> 3.1.32.0-1
changelog:
  - Release 3.1.32.0-1
  	See https://github.com/snort3/snort3/releases/tag/3.1.32.0 for a list of changes


author: Lawrence R. Rogers <lrr@cert.org> 3.1.38.0-1
changelog:
  - Release 3.1.38.0-1
  	See https://github.com/snort3/snort3/releases/tag/3.1.38.0 for a list of changes


author: Lawrence R. Rogers <lrr@cert.org> 3.1.39.0-1
changelog:
  - Release 3.1.39.0-1
  	See https://github.com/snort3/snort3/releases/tag/3.1.39.0 for a list of changes


author: Lawrence R. Rogers <lrr@cert.org> 3.1.40.0-1
changelog:
  - Release 3.1.40.0-1
  	See https://github.com/snort3/snort3/releases/tag/3.1.40.0 for the list of changes


author: Lawrence R. Rogers <lrr@cert.org> 3.1.41.0-1
changelog:
  - Release 3.1.41.0-1
  	See https://github.com/snort3/snort3/releases/tag/3.1.41.0 for the list of changes


author: Lawrence R. Rogers <lrr@cert.org> 3.1.42.0-1
changelog:
  - Release 3.1.42.0-1
  	See https://github.com/snort3/snort3/releases/tag/3.1.42.0 for the list of changes


author: Lawrence R. Rogers <lrr@cert.org> 1.8.0-1
changelog:
  * Release 1.8.0-1
  	Added a new switch, --rewrite-ssl-certs, which restructures the template used for TLS/SSL certificates for IPFIX exporters. The template uses specific IEs for some fields in an SSL certificate.
  		The --rewrite-ssl-certs switch also allows a super_mediator to read the new SSL template from an upstream super_mediator. Deduplication of the rewritten certificates is not supported.
  	Added the ability to read the new SMTP DPI records exported by YAF 2.12.0.
  	Added the observation domain ID to JSON output.


author: Lawrence R. Rogers <lrr@cert.org> 1.9.0-1
changelog:
  * Release 1.9.0-1
  	Added support for labeling records based on data from a SiLK IPSet or a SiLK Prefix Map.
  	Added support for labeling records with a sensor and flowtype similar to SiLK's rwflowpack tool.
  	Added support for OpenSSL 3.0.1.
  	Changed JSON output of SSL records for unknown sslObjectType values: For unknown value X, key sslCertObjectIDX is replaced by sslCertIssuerObjectIdX or sslCertSubObjectIdX.
  		When X is 1, EmailAddress is used (e.g., sslCertIssuerEmailAddress) and when X is 25 DomainComponent is used.
  	Changed the super_mediator.spec file to configure the build using --with FEATURE options to rpmbuild.
  	Fixed a small bug in JSON output of rewritten SSL certificates.
  	Fixed bugs in TEXT export of very old YAF SSL data.
  	Changed the template scopes for the YAF stats template and Tombstone template to match those used by YAF.


author: Lawrence R. Rogers <lrr@@cert.org> - 0.2-2
changelog:
  - Release 0.2-2
  	This version now builds the virtual environment at package building time, not at package installation time.


author: Lawrence R. Rogers <lrr@cert.org> 1.2.2-3
changelog:
  * Release 1.2.2-3
  	Due to changes in PHP, the previous version no longer works.
  	This version uses a container based on Ubuntu.
  	The container can be found at certlifter/xplico-1.2.2:3.
  	Note that the Dockerfile is provided as part of this package.


author: Lawrence R. Rogers <lrr@cert.org> 2.11.2-1
changelog:
  * Release 2.11.2-1
  	Fixed bugs in NTP and DNS deep packet inspection.
  	Fixed a compilation error when building with metadata export enabled.
  	Fixed possible compilation errors when building with nDPI support.
  	Fixed compilation errors when building with newer versions of PF_Ring.


author: Lawrence R. Rogers <lrr@cert.org> 2.12.1-1
changelog:
  * Release 2.12.1-1
  	Changed the templates and IEs used for SMTP DPI. The new templates use different IDs than those used by previous releases of YAF.
  		super_mediator-1.8.0 or later is required to read this format. Currently there is no version of Analysis Pipeline that reads the SMTP DPI.
  	First public release of YAF 2.12.x.


author: Lawrence R. Rogers <lrr@cert.org> 2.12.2-1
changelog:
  * Release 2.12.2-1
  	Added new protocols to the yafAppLabelRules.conf file and updated several regular expressions.
  	Changed the regexes used by the SMTP DPI plugin and improved capture when multiple messages appear in a single SMTP session.
  	Fixed a crash in the SMTP DPI plugin when reading uniflow records.
  	Updated the POP3 DPI plugin.
  	Updated yafzcbalance to be compatibile with PF_Ring-8.


