# changelog

author: Sérgio Basto <sergio@serjux.com> - 0.99.3-7
changelog:
  - Remove sub-packages sysvinit, upstart and systemd to be more compatible with
    el6 .
  - Remove provides/obsoletes for very old sub-packges clamav-milter-core,
    clamav-milter-sendmail and clamav-milter-core
  - Call server and scanner sub-packages as clamd (el6 compatible and as uppstream
    call it)
  - clamav-data provides clamav-db (el6 compatible)
  - Explicitly enable-id-check and enable-dns in configure (as in el6).
  - Add missing build-time requirement pcre2-devel (it misses in el6 at least)


author: Orion Poplawski <orion@nwra.com> - 0.99.4-1
changelog:
  - Update to 0.99.4
  - Security fixes CVE-2012-6706 CVE-2017-6419 CVE-2017-11423 CVE-2018-1000085
    CVE-2018-0202


author: Sérgio Basto <sergio@serjux.com> - 0.99.4-2
changelog:
  - Revert fix for llvm, build using -std=gnu++98 (#1307378)
  - Revert CFLAG assignment in commmit a4a6d252 (made in 2006)
  - BR systemd-devel to fix detection in configure.
  - Disable llvm in ppc64 (#1534071)
  - "Disable llvm will use the internal bytecode interpreter rather than the llvm
    jit", so drop bytecode build condition and use condional on enable or disable
    llvm.


author: Sérgio Basto <sergio@serjux.com> - 0.100.0-2
changelog:
  - Try to mitigate bug #1583599
  - Move comments one line (to read before starting the scriptlet)
  - clamav-milter could work without clamd and without sendmail (#1583599)
  - Get rid of provides/requires with updateuser, virusgroup, scanuser and
    milteruser and just simply require clamav-filesystem


author: Sérgio Basto <sergio@serjux.com> - 0.100.0-3
changelog:
  - Remove sub-package clamav-data-empty
  - Also remove conflicts between clamav-data and clamav-data-empty


author: Sérgio Basto <sergio@serjux.com> - 0.100.1-3
changelog:
  - Modify group of /var/run/clamd.scan to virusgroup
  - Add some SELinux notes from (#787434)
  - Drop pointless clamav-0.99.1-setsebool.patch
  - Drop conditionalized build of noarch


author: Sérgio Basto <sergio@serjux.com> - 0.100.1-4
changelog:
  - Change the default location of configuration files in clamconf, binaries and
    man pages, replacing with our default packaging (#859339).


author: Sérgio Basto <sergio@serjux.com> - 0.100.2-1
changelog:
  - Update to 0.100.2
  - Fix logrotate example (#1610735)
  - Improve clamd@.service (enter in commit "clean whitespace" by mistake sorry)


author: Jirka Hladky <hladky.jiri@gmail.com> - 1.4-3
changelog:
  - PIDFile should be stored at /run instead of the default location /var/run 
  - There is  long term plan that directory /var/run will not further exist in the future Fedora versions
  - Asked upstream to add -p <PID_FILE_location> switch to influence the location of the PID File
  - Set PIDFile=/var/run/haveged.pid This is needed as long -p option is not implemented
  - https://bugzilla.redhat.com/show_bug.cgi?id=770306#c10


author: Jirka Hladky <hladky.jiri@gmail.com> - 1.5-1
changelog:
  - Update to the version 1.5
  - Main new feature is a run time verification of the produced random numbers
  - PIDFILE set to /run/haveged.pid
  - converted README and man page to UTF-8. Informed the upstream to fix it.


author: Jirka Hladky <hladky.jiri@gmail.com> - 1.5-2
changelog:
  - BZ 850144
  - Introduce new systemd-rpm macros in haveged spec file
  - Fedora 19 changes the way how to work with services in spec files. 
  - It introduces new macros - systemd_post, systemd_preun and systemd_postun; 
  - which replace scriptlets from Fedora 18 and older
  - see https://fedoraproject.org/wiki/Packaging:ScriptletSnippets#Systemd


author: Jirka Hladky <hladky.jiri@gmail.com> - 1.8-1
changelog:
  - Unversioned docdir change, more info on 
    https://fedoraproject.org/wiki/Changes/UnversionedDocdirs


author: Bruno E. O. Meneguele <brdeoliv@redhat.com> - 1.0-1
changelog:
  - New upstream release
  - Remove libtool files
  - Run ldconfig after un/installation to update *.so files
  - Add -devel subpackage to handle include files and examples


author: Bruno E. O. Meneguele <brdeoliv@redhat.com> - 1.1-1
changelog:
  - New upstream release
  - Adjusted docbook xsl path to match the correct stylesheet
  - Remove only *.la files, considering there aren't any *.a files


author: Mathieu Bridon <bochecha@fedoraproject.org> - 4.11-2
changelog:
  - Make a patch out of Michal's pkgconfig support.
  - Modernize the configure.ac file for Automake >= 1.13.
  - Respect the Fedora CFLAGS
    https://bugzilla.redhat.com/show_bug.cgi?id=908096


author: Mathieu Bridon <bochecha@fedoraproject.org> - 4.15-3
changelog:
  - Get the package closer to what upstream intended:
    - Do not move the headers into a subfolder of /usr/include
    - Make a libev-libevent-devel subpackage to contain the libevent
      compatibility header, so that only this subpackage conflicts with
      libevent-devel, not all of libev-devel
    - Drop the pkgconfig file, as upstream rejected it several times already.


author: Wolfgang Ulbrich <chat-to-me@raveit.de> - 1.7.2-1
changelog:
  - update to 1.7.2
  - use modern 'make install' macro
  - remove needless gsettings convert file
  - use --with-gnome --all-name for find locale
  - add BR libICE-devel
  - fix ld scriptlets


author: Wolfgang Ulbrich <chat-to-me@raveit.de> - 1.7.90-1
changelog:
  - update to 1.7.90 release
  - use --with-gnome --all-name for find locale
  - enable python bindings, add BR pygtk2-devel


author: - Andreas Schneider <asn@redhat.com> - 0.6.1-1
changelog:
  - Update to version 0.6.1.
  - resolves: #1056757 - Fix scp mode.
  - resolves: #1053305 - Fix known_hosts heuristic.


author: Wolfgang Ulbrich <fedora@raveit.de> - 1.16.0-2
changelog:
  - fix for https://github.com/mate-desktop/marco/issues/251
  - https://bugzilla.redhat.com/show_bug.cgi?id=1419634


author: Wolfgang Ulbrich <chat-to-me@raveit.de> - 1.12.1-1
changelog:
  - update to 1.12.0 release
  - add mate-mimeapps.list
  - add runtime require mate-user-guide
  - remove upstreamed patch
  - user-guide is now a single package again
  - update rpm scriptlets


author: Wolfgang Ulbrich <chat-to-me@raveit.de> 1.7.1-1
changelog:
  - update to 1.7.1 release
  - add missing changelog entry from previous build
  - add --with-gnome --all-name for find language
  - use modern 'make install' macro


author: Wolfgang Ulbrich <chat-to-me@raveit.de> - 1.16.0-2
changelog:
  - fix resizing the startup applications preferences window
  - https://github.com/mate-desktop/mate-session-manager/commit/d8da9ef


author: Ben Woodard <woodard@redhat.com
changelog:
  - removed dot at end of summary
  - removed unused/broken smp build
  - changed to using initrddir macro
  - changed depricated Prereq to Requires


author: Ben Woodard <woodard@redhat.com>
changelog:
  - add parameters to make
  - replace etc with _sysconfdir in most places
  - remove post section with unexplained removing of cached man pages.
  - removed dots at end of all summaries.


author: John K. Harvey <john.harvey@crunchydata.com> - 9.6.6-3PGDG
changelog:
  - Fixes for CVE-2017-12172 (EL-6 only)
  - Update TimeOutSec parameter to match systemd docs (EL-7 only)


author: Devrim Gündüz <devrim@gunduz.org> - 9.6.7-1PGDG-1
changelog:
  - Update to 9.6.7, per changes described at:
    https://www.postgresql.org/docs/devel/static/release-9-6-7.html


author: Devrim Gündüz <devrim@gunduz.org> - 9.6.8-1PGDG-1
changelog:
  - Update to 9.6.8, per changes described at:
    https://www.postgresql.org/docs/devel/static/release-9-6-8.html


author: Devrim Gündüz <devrim@gunduz.org> - 9.6.9-1PGDG-1
changelog:
  - Update to 9.6.9, per changes described at:
    https://www.postgresql.org/docs/devel/static/release-9-6-9.html
  - Build hstore_plpyton and ltree_plpython with PY3 as well. This
    is a backport of 969cf62e70e6f97725f53ac70bf07214555df45d .


author: Devrim Gündüz <devrim@gunduz.org> - 9.6.10-1PGDG-1
changelog:
  - Update to 9.6.10, per changes described at:
    https://www.postgresql.org/docs/devel/static/release-9-6-10.html


author: Devrim Gündüz <devrim@gunduz.org> - 9.6.11-1PGDG-1
changelog:
  - Update to 9.6.11, per changes described at:
    https://www.postgresql.org/docs/devel/static/release-9-6-11.html
  - Fix upgrade path setup script, and add check_upgrade as well.


author: Devrim Gündüz <devrim@gunduz.org> - 9.6.5-2PGDG-1
changelog:
  - Fix #1289 (OOM killer control for PostgreSQL)
  - Do not set any timeout value, so that systemd will not kill postmaster
    during crash recovery. Fixes #2786.


author: Devrim Gündüz <devrim@gunduz.org> - 9.6.6-1PGDG-1
changelog:
  - Update to 9.6.6, per changes described at:
    https://www.postgresql.org/docs/devel/static/release-9-6-6.html


author: Nick Miller <nick.miller@onyxpoint.com> - 0.2.2-0
changelog:
  - SIMPed module
  - Wrote more spec tests
  - Added a few config options to the defaults
  - Added details to metadata.json
  - Added CentOS as a supported OS
  - Fixed lint errors


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 1.0.2-0
changelog:
  - Fixed README typos
    - Cleaned up code
    - Added acceptance tests
    - Added support for `auth_membership`
    - Fixed code regression from d49cf32
      - Thanks for the notification from John Warburton
    - Validated noop message was correct
    - Fixed sort order when checking user lists against the system


author: Nick Markowski <nicholas.markowski@onyxpoint.com> - 1.0.4-0
changelog:
  - 1.0.3 was tagged, bumping to 1.0.4
  - Fix addresses https://github.com/onyxpoint/puppet-gpasswd/issues/7
  - Before this fix, users could not specify groups in the system
    GID range, SYS_GID_[MAX,MIN] in /etc/login.defs. Added system_groups
    feature to gpasswd.
  - Added beaker tests to ensure groups can be created within the system range.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 1.0.6-0
changelog:
  - Refactored the module to work with Puppet > 5.5.6
    - Puppet 5.5.7 broke the Type/Provider interface in the 'group' type so
      required an emergency refactor


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 1.0.3-0
changelog:
  - Validate functionality under Puppet 5
  - Test against Oracle Enterprise Linux
  - Change default state of the acpid package to reference
    `simp_options::package_ensure`, defaulting to `installed`


author: Nick Markowski <nmarkowski@keywcorp.com> - 1.0.1-alpha
changelog:
  - You can now pass 'instance' and 'server_config' to the simp activemq, and
    reasonable defaults were set.


author: Nick Markowski <nmarkowski@keywcorp.com> - 3.0.0-0
changelog:
  - Updated module to the latest for enhanced features and deprecation
    of the tanukiwrapper dependency.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.1.0-0
changelog:
  - Fixed bug whereby aide reports/errors were not being sent to syslog.
    AIDE can now be configured to report to syslog, itself.
  - Use FIPS-appropriate hash algorithms when in FIPS mode
  - No longer hide AIDE initialization failures (which are primarily
    configuration errors) when a manifest with the aide class is applied.
  - Improved acceptance tests.
  - Commented out SUSE acceptance test node, as the node configuration
    is broken.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.1.1-0
changelog:
  - Retain output database upon AIDE database update for SCAP
    Security Guide OVAL check
    xccdf_org.ssgproject.content_rule_aide_build_database


author: Trey Dockendorf <tdockendorf@osc.edu> - 6.1.3-0
changelog:
  - Add `aide::cron_command` to allow user modification.
  - Ensure that the package is explicitly installed before any dependent
    resources.


author: Nick Miller <nick.miller@onyxpoint.com> - 6.2.0-0
changelog:
  - Added $package_ensure parameter
    - Changed the package from 'latest' to 'installed'
    - It will also respect `simp_options::package_ensure`


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.2.2-0
changelog:
  - Replace use of simplib's deprecated Puppet 3 validate_between
    with Simplib::Cron::* types.  This change allows more flexibility
    in cron scheduling.


author: Steven Pritchard <steven.pritchard@onyxpoint.com> - 6.3.0-0
changelog:
  - Add v2 compliance_markup data
  - Drop support for Puppet 4
  - Add support for Puppet 6
  - Add support for puppetlabs-stdlib 6


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.0.3
changelog:
  - Ensure that entries in 'at.allow' are not commented out by default
  - Updated the Gemfile to pin to the latest working Beaker


author: Nick Markowski <nmarkowski@keywcorp.com> - 5.0.2-0
changelog:
  - Added a default audit rule for 'renameat', per CCE-26651-0.
  - Added an auditd_version fact.
  - Updated validation for *_action lists to differentiate between
    auditd versions.
  - Updated module to use new rake helper to auto-gen .spec file.


author: Jeanne Greulich, Liz Nemsick - 5.1.0-0
changelog:
  - Allow user to specify syslog facility and priority for audit record
    messages.
  - Allow user to enable/disable audit record syslog messaging independent
    of the presence of forwarding logging servers.
  - Added a file resource to detect and fix incorrect permissions on the
    /var/log/audit/audit.log file.


author: Nick Markowski <nmarkowski@keywcorp.com> - 7.0.0-0
changelog:
  - Updated global catalysts
  - Changed default log facility to local5.
  - Added a drop rule for crond events


author: Ralph Wright <rwright@onyxpoint.com> - 7.0.0-0
changelog:
  * Mon Dec 26 2016 Trevor Vaughan <tvaughan@onyxpoint.com> - 7.0.0-0
  - Refactor to work in Puppet 4 Changes
  - Updated acceptance tests


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 7.0.0-0
changelog:
  - In response to the DISA STIG Requirements
    - Added 'open_by_handle_at' to the 'access' key
    - Added watches on /varlog/faillock and /var/log/tallylock
    - Added watches on /usr/sbin/insmod and /bin/kmod
    - Added permissions modification notification for 'chmod'
  - Renamed auditd::add_rules to auditd::rule
  - Split the audit permissions rules into separate lines
  - Disabled chmod auditing by default


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 7.0.1-0
changelog:
  - Changed auditd::failure_mode to '1' by default since the compliant audit
    rules were causing routine system restarts. The new value will default to
    sending printk messages when the buffer is full.
  - Changed all rules that were exit,always to be always,exit


author: Nicholas Hughes <nicholasmhughes@github.com> - 7.0.1-0
changelog:
  - Audit kernel module tools from /usr/bin as well as /bin and /sbin
  - Correct auditing /var/log/tallylock, it should have been /var/log/tallylog


author: Liz Nemsick <lnemsick.simp@gmail.com> - 7.0.2-0
changelog:
  - Fix bug whereby audit.rules file was not being regenerated prior
    to auditd service start in CentOS/RedHat 6.
  - Update puppet version in metadata.json


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 7.1.0-0
changelog:
  - Updated to use augeasproviders_grub 3
  - Added the ability to log calls to the 'rpm' and 'yum' commands


author: Nick Markowski <nicholas.markowski@onyxpoint.com> - 7.1.3-0
changelog:
  - Updated compliance suite to use new inspec profile,
    https://github.com/simp/inspec-profile-disa_stig-el7
  - Removed the el6 nodeset from the compliance suite; there are no
    simp-supported el6 inspec profiles at this time.
  - Ensured git installed as it's a dependency of our inspec profiles


author: Liz Nemsick <lnemsick.simp@gmail.com> - 8.0.0-0
changelog:
  - Added ability to select one or more audit profiles.  When multiple
    profiles are selected, their rules are effectively concatenated in
    the order in which the profiles are listed in
    auditd::default_audit_profiles.
  - The following API Changes were made in support of multiple audit
    profiles:
    - $::auditd::$default_audit_profile has been deprecated by
      $::auditd::$default_audit_profiles
    - auditd::config and auditd::config::audit_profiles::simp classes are
      now private.  In the unlikely event that you included just these
      classes in your manifest, you must now include auditd instead.
    - The following auditctl global configuration options that were in
      auditd::config::audit_profiles::simp are now in the auditd class,
      instead: $ignore_errors, $ignore_anonymous, $ignore_system_services,
      and $ignore_crond. They were moved because they are now applied to
      the set of audit profiles selected, not just the 'simp' audit
      profile.
    - The following auditd::config::audit_profiles::simp class parameters
      have been deprecated for clarity:
      - $audit_sudoers has been deprecated by $audit_cfg_sudoers
      - $audit_sudoers_tag has been deprecated by $audit_cfg_sudoers
      - $audit_grub has been deprecated by $audit_cfg_grub
      - $audit_grub_tag has been deprecated by $audit_cfg_grub_tag
      - $audit_yum has been deprecated by $audit_cfg_yum
      - $audit_yum_tag has been deprecated by $audit_cfg_yum_tag
    - Some previously hard-coded, internal configuration is now exposed
      as data-in-modules.
  - Added 'stig' audit profile which manages rules that match DISA STIG
    checks, exactly.
    - For executables explicitly listed in the RHEL7 STIG, includes watchs
      for binaries in the real paths (/usr/bin, /usr/sbin) and linked paths
      (/bin, /sbin). This is to address inconsistencies among the STIG and
      the Inspec and OSCAP scans. (All should use the real paths, but don't.)
  - Fixed bugs in 'simp' audit profile
    - Fixed umask syscall rules.  These rules require arch filters.
    - Fixed clock_settime syscall rules.  Per the sample STIG audit rules
      packaged in the auditd RPM, these rules require an 'a0' filter.
    - Fixed bug in which /var/log/tallylog was grouped with session
      instead of logins.
    - Fixed bug in which the /etc/pam.d watch rule had the wrong tag
  - Updated 'simp' audit profile settings for DISA STIG.
    - Expanded the list of successful syscall operations audited.
    - Expanded the list of module syscall operations audited
    - Added an option to monitor selinux commands, (i.e., chcon,
      semanage, setfiles, setsebool)
    - Added an option to audit the execution of password commands
      ('passwd', 'unix_chkpwd', 'gpasswd', 'chage', 'userhelper')
    - Added an option to audit the execution of privilege-related
      commands ('su', 'sudo', 'newgrp', 'chsh', 'sudoedit')
    - Added an option to audit the execution of postfix-related commands
      ('postdrop', 'postqueue')
    - Added an option to audit the execution of the 'ssh-keysign' command
    - Added an option to audit the execution of the 'crontab' command
    - Added an option to audit the execution of the 'pam_timestamp_check'
      command
    - Added an option to audit the execution of rename/remove operations
      for non-service users (rename', 'renameat', rmdir', 'unlink', and
      'unlinkat')
    - Added watch rules for /etc/hostname and /etc/NetworkManager (for
      centos7) pulled from the sample STIG audit rules packaged in the
      auditd RPM.
    - For executables explicitly listed in the RHEL7 STIG, includes watchs
      for binaries in the real paths (/usr/bin, /usr/sbin) and linked paths
      (/bin, /sbin). This is to address inconsistencies among the STIG and
      the Inspec and OSCAP scans. (All should use the real paths, but don't.)


author: Trey Dockendorf <tdockendorf@osc.edu> - 8.0.1-0
changelog:
  - Allow lowercase values for several parameters in accordance with the man
    pages and SCAP expectations.


author: Brandon Ess <brandon.ess@gmail.com> - 8.1.0-0
changelog:
  - Align group ownership of the auditd log directories with the setting for
    auditd itself so that the designated group can access the log files.


author: Nick Miller <nick.miller@onyxpoint.com> - 8.1.0-0
changelog:
  - Changed the $package_ensure parameter from 'latest' to 'installed'
  - It will also respect `simp_options::package_ensure`


author: Nick Markowski <nicholas.markowski@onyxpoint.com> - 8.1.0-0
changelog:
  - Removed unnecessary dependencies from metadata.json.  Now, when users install
    auditd stand-alone i.e. `puppet module install`, they will not have
    extraneous modules clutter their environment.
    - herculesteam/augeasproviders_grub
    - simp/rsyslog


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 8.1.0-0
changelog:
  - Allow users to opt-out of hooking the audit dispatchers into the SIMP rsyslog
    module using `auditd::config::audisp::syslog::rsyslog = false` or,
    alternatively, setting `simp_options::syslog = false`.
  - Add a `write_logs` opttion to the `auditd_class` and multiplex between the
    `log_format = NOLOG` setting and `write_logs = false` since there were
    breaking changes in these settings after `auditd` version `2.6.0`.
  - Add support for `log_format = ENHANCED` for `auditd` version >= `2.6.0`.
    Older versions will simply fall back to `RAW`.


author: Mark Leary <leary.mark@gmail.com> - 8.1.1-0
changelog:
  - Revert back to using the native service provider for the auditd service since
    puppet fixed the service handling.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 8.2.1-0
changelog:
  - Use Puppet Integer in lieu of simplib's deprecated Puppet 3 to_integer
  - Expanded the upper limit of the stdlib Puppet module version
  - Updated a URL in the README.md


author: Jim Anderson <thesemicolons@protonmail.com> - 8.2.1-0
changelog:
  - config.pp now managed /etc/audit in addition to /etc/audit/rules.d.
    The permissions and ownership of the two directories should be the
    same. Both directories use purge and recurse.


author: Joseph Sharkey <shark.bruhaha@gmail.com> - 8.2.1-0
changelog:
  - Ensure that space_left is always larger than admin_space_left
  - Updated tests in support of puppet6, and removed puppet4 support
  - Updated puppet template scope API from 3 to newer


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 8.3.0-0
changelog:
  - Added a `custom` audit profile that accepts either an Array of rules or a
    template path for ease of setting full rulesets via Hiera.
  - Updated all module components for `puppet strings`
  - Fixed the README
  - Added a REFERENCE.md
  - Refactored the filename logic in the base profiles to be simpler
  - Converted the rule template to EPP
  - Converted the rotated_audit_logs template to EPP
  - Converted STIG audit profile template to EPP
  - Converted SIMP audit profile template to EPP


author: Liz Nemsick <lnemsick.simp@gmail.com> - 8.3.1-0
changelog:
  - Fix a breaking change inadvertantly introduced into auditd::rule
    in which the auditd class was no longer included when an auditd::rule
    was defined in a manifest.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 8.3.2-0
changelog:
  - Fix an issue where trailing newlines may not be present on custom rule
    profiles, particularly with rules defined in an Array.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 4.1.3-0
changelog:
  - Fixed an issue where the filenames used by 'concat' could contain '/' which
    made them unfit for system use.
  - Also added 'audit' options to the file resources that control the 'autofs'
    service restarts.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.0.0-0
changelog:
  - Ripped out all NFS materials
  - NFS can now work with the configuration of autofs but there should not have
    been a strong dependency the other way


author: Nick Miller <nick.miller@onyxpoint.com> - 6.1.0-0
changelog:
  - Allowed for control of specific versions of the packages in this
    module with two new parameters:
    - samba_package_ensure
    - autofs_package_ensure
  - Support Puppet 5


author: Nicholas Markowski <nicholas.markowski@onyxpoint.com> - 6.1.2-0
changelog:
  - Updated $app_pki_external_source to accept any string. This matches the
    functionality of pki::copy.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.1.3-0
changelog:
  - Expanded the upper limit of the concat and stdlib Puppet module versions
  - Fixed a URL in the README.md


author: Steven Pritchard <steven.pritchard@onyxpoint.com> - 6.2.0-0
changelog:
  - Add v2 compliance_markup data
  - Drop Puppet 4 support
  - Add Puppet 6 support
  - Add puppetlabs-stdlib 6 support


author: Joseph Sharkey <shark.bruhaha@gmail.com> - 0.2.0-0
changelog:
  - Standardized cron datatypes to use the Simplib::Cron::### types.  This
    allows more flexibility in cron scheduling.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 4.1.0-5
changelog:
  - Updated to use the new 'simp' environment.
  - Changed calls directly to /etc/init.d/rsyslog to '/sbin/service rsyslog' so
    that both RHEL6 and RHEL7 are properly supported.


author: Nick Markowski <nmarkowski@keywcorp.com> - 4.1.0-6
changelog:
  - Added enable_clamav parameter to toggle: package install,
    freshclam/clamscan cron jobs, clamav rsync, antivirus selboolean.
  - The clamav user, group now manageable and package name mutable.
  - Added validation to init.pp


author: Nick Markowski <nmarkowski@keywcorp.com> - 6.0.1-0
changelog:
  - Updated logrotate to use new lastaction API
  - Update puppet dependency and remove OBE pe dependency in metadata.json


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 6.1.0-0
changelog:
  - Add package_ensure parameter to use simp_options package_ensure value
    for managing the installation of packages.
    If simp_options is not being used it will default to install (
    previously set to latest)
    If not using simp_options the value  can be changed  by setting clamav::package_ensure
    to latest in hiera.
  - update Gemfile to use puppet ~> 5.0
  - update .rubyversion to 2.4.4


author: Chris Tessmer <ctessmer@onyxpoint.com> - 1.0.0-0
changelog:
  - Move Forge org from `onyxpoint` to `simp`
    - Provide Ruby 1.8.7 compatibility
    - Ensure that a report is written on every run.
    - Updated to properly handle the hash references


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 2.0.0-0
changelog:
  - New map format
    - New output format
      - Added compliant values
      - Added missed parameters
      - Added missing class references
      - Added server-side storage
    - Added a conversion utility in the 'utils' directory


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 2.1.0-0
changelog:
  - Documented the report format in the README
    - Added the defaut SIMP compliance profiles to the module data
    - Enhanced the lookup mapper function to take an optional default map
    - Passed the internal data as the default map
    - Added client metadata to the compliance report for easier analysis
    - Fixed several minor processing bugs
    - Added the documented, but missing, regular expression match capability
    - Confine puppet version in metadata.json


author: Lucas Yamanishi <lucas.yamanishi@onyxpoint.com> - 2.3.0-0
changelog:
  - Converted compliance profiles to JSON.  This allows non-string values
    and faster deserialization.
  - Provided scripts in 'utils/' to convert the compliance profiles from
    YAML to JSON and vice versa.


author: Dylan Cochran <dylan.cochran@onyxpoint.com> - 2.3.1-0
changelog:
  - Refactor report generator to use a shared file format parser/compiler.
  - Add vendored 'profiles-in-modules' support


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 2.3.3-0
changelog:
  - Aligned the EL7 disa_stig profile with the latest SSG content
  - Fixed several parameters with incorrect data types


author: Nick Markowski <nicholas.markowski@onyxpoint.com> - 2.3.3-0
changelog:
  - Further aligned the EL7 disa_stig profile with scap-security-guide 0.1.33-5
    - Added oval-ids to map puppet parameters to openscap tests and SIMP
      remediations.  Note this mapping is NOT complete.
  - See simp/doc for a policy evaluation response report for CentOS 7
    - Includes remedies and justifications to address failures in
      the openscap scan


author: Liz Nemsick <lnemsick.simp@gmail.com> - 2.3.3-0
changelog:
  - Updated TMOUT setting in /etc/profile.d/simp.sh to match EL7 STIG
    setting (Reference: RHEL-07-040160)
  - Added missing audispd program to simp_rsyslog::default_logs
  - Added missing ' IPT:' message start to simp_ryslog::default_logs.
    This is required for iptables violation messages because some
    versions of rsyslog add a space separating the message
    timestamp/id and the message.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 2.3.4-0
changelog:
  - DISA STIG changes:
    - Added auditd::action_mail_acct entries
    - Added auditd::config::audit_profiles::simp::audit_sudoers
    - Added auditd::config::audit_profiles::simp::audit_selinux_cmds
    - Added auditd::failure_mode
    - Corrected auditd::enable identifiers


author: Chris Tessmer <chris.tessmer@onyxpoint.com> - 2.3.4-0
changelog:
  - DISA STIG changes:
    - Added auditd::config::audit_profiles::simp::audit_session_files
    - Added auditd::config::audit_profiles::simp::audit_session_files_tag


author: Nick Miller <nick.miller@onyxpoint.com> - 2.3.4-0
changelog:
  - DISA STIG changes:
    - Added auditd::config::audit_profiles::simp::audit_crontab_cmd
    - Added auditd::config::audit_profiles::simp::audit_pam_timestamp_check_cmd
    - Added auditd::config::audit_profiles::simp::audit_passwd_cmds
    - Added auditd::config::audit_profiles::simp::audit_postfix_cmds
    - Added auditd::config::audit_profiles::simp::audit_priv_cmds
    - Added auditd::config::audit_profiles::simp::audit_ssh_keysign_cmd


author: Liz Nemsick <lnemsick.simp@gmail.com> - 2.3.4-0
changelog:
  - DISA STIG changes:
    - Updated for pupmod-simp-auditd 8.0.0.  This enforces the
      'stig' audit profile, instead of the 'simp' audit profile.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 2.3.4-0
changelog:
  - Change 'sudosh' to 'tlog' to support the switch to supported session logging
    software
  - Added support for Puppet 5 and OEL
  - DISA STIG changes:
    - Added selinux::login_resources
    - Added gdm::settings
    - Added gdm::banner
    - Added gdm::simp_banner
    - Added gdm::dconf_hash
    - Added gnome::dconf_hash


author: Dylan Cochran <dylan.cochran@onyxpoint.com> - 2.4.0-0
changelog:
  - Open-Source SCE version 2.0
    - Add bugfix for environments that are just Strings vs Environment objects.
    - Add compliance_markup::loaded_maps() function to return all of the loaded
      compliance data from the puppetserver for debugging
    - Add compliance_markup::telemetry() function to return filenames used to
      load compliance data
    - Add compliance_markup::debug::dump hiera parameter that dumps the cached
      result hash for hiera debugging.
    - Remove pupmod::ca_crl_pull_interval from nist_800_53_rev4.json's since
      the parameter is deprecated.
    - refactor loader to look in:
      - "/SIMP/compliance_profiles"
      - "/simp/compliance_profiles"
      and for backwards compatbility:
      - "/lib/puppetx/compliance"


author: Liz Nemsick <lnemsick.simp@gmail.com> - 2.4.1-0
changelog:
  - Fixed the following incorrect parameter types
    - simp::yum::schedule::minute
    - simp::yum::schedule::hour


author: Steven Pritchard <steven.pritchard@onyxpoint.com> - 2.4.1-0
changelog:
  - Fix the following keys:
    - simp::mountpoints::tmp::secure
    - simp::root_user::manage_group
    - simp::root_user::manage_perms
    - simp::root_user::manage_user
    - ssh::server::conf::pki


author: Steven Pritchard <steven.pritchard@onyxpoint.com> - 2.4.2-0
changelog:
  - Compliance_map_migrate improvements
    - Merge values from multiple input files.
    - Make 'check_header' consistent with other v2 data.
    - Reorder output to match other v2 data.
    - Fix controls, oval-ids, and identifiers output.
    - Normalize identifier strings.
    - Add option to supply confinement.
    - Use a strange YAML incantation to avoid anchors in the output.
    - Add option to append a string to the checks key.
    - Add additional helper scripts for v1 to v2 migration.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 2.4.3-0
changelog:
  - Fix Puppet 6 support in the compliance_map function
  - Dropped Puppet 4 support
  - Fixed bug in the compliance report functionality that did not correctly
    record the percent compliant in each report summary


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 2.4.4-0
changelog:
  - Revert change from __dir__ to File.dirname(__FILE__) in compliance_map.rb due
    to discovered incompatibility with some puppetserver configurations.
  - Add log statement if invalid JSON or YAML files are found when loading.
  - Remove management of simp::sssd::client::ldap_domain from the mappings since
    use of LDAP is not guaranteed.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 3.0.0-0
changelog:
  - Converted the `compliance_map` function to a Puppet 4 function called
    `compliance_markup::compliance_map()`
  - The old puppet 3 function is deprecated and will be removed in the 3.1.0-0
    release of this module
  - Make the 'timestamp' in the client-side report optional to prevent puppet
    from triggering file resource changes every time
  - Remove the experimental v1 data since it is no longer used
  - Remove partial v2 data sets
  - Add v2 data for the non-SIMP `yum` module


author: Nick Miller <nick.miller@onyxpoint.com> - 0.0.2
changelog:
  - Removed deprecated audit metaparameter
  - Added basic acceptance test
  - Made sure the cron::user class doesn't use the pam module if pam is false
  - Update puppet dependency and remove OBE pe dependency in metadata.json


author: Liz Nemsick <lnemsick.simp@gmail.com> - 0.1.1
changelog:
  - Fix a bad URL in the README.md
  - Expand the range of stdlib Puppet module versions required in metadata.json


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.0.3
changelog:
  - Fix issue with duplicate resources when creating multiple `dconf::settings`
    resources under the same namespace.


author: Jeanne Greulich <jeannegreulich@onyxpoint.com> - 0.1.0
changelog:
  - This module supports adding lists of packages to the catalog after the all
    the manifests have been compiled.  Its purpose is to support policy
    enforcement for the SIMP project and is not meant for general purpose use.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.2.0
changelog:
  - Add deferred_resources::users
  - Add deferred_resources::groups
  - Add deferred_resources::files
  - Add 'override_existing_attributes' capability to the 'deferred_resources'
    native type
  - Drop Puppet 4 support
  - Add Puppet 6 support


author: Nicholas Hughes, Nick Markowski <nmarkowski@keywcorp.com> - 6.0.0-0
changelog:
  - Prevent log duplication and log where intended.
  - Changed naming to XX_ or YY_ to come before the default Z_default.conf
    for local rules, but after the numbered configs used by the log_server
    class.


author: Nick Miller <nick.miller@onyxpoint.com> - 6.1.0-0
changelog:
  - Added $dhcp::dhcpd::package_ensure parameter
    - Changed the package from 'latest' to 'installed'
    - It will also respect `simp_options::package_ensure`
  - Remove support for Puppet less than 4.10.4
  - Add Puppet Strings documentation
  - Update badges and contribution guide URL in README.md


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.1.1-0
changelog:
  - Use simplib::passgen() in lieu of passgen(), a deprecated simplib
    Puppet 3 function.
  - Update the upper bound of stdlib to < 6.0.0
  - Update a URL in the README.md


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 0.1.1-0
changelog:
  - The simp_options::fips catalyst did not disable fips; changed enable
    variable to default to simp_options::fips
  - Moved check for OS family from params to init
  - Added package remove for dracut-fips packages if fips is disabled


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.1.2-0
changelog:
  - Created a work-around for an undocumented issue where /boot is not
    on its own partition but is added to the kernel parameters with
    fips=1. This situation ends up creating a kernel panic on the
    system until the boot= entry is removed from the kernel boot line.
  - Added tests against GCE since that is the default image configuration
    on those systems.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.1.2-0
changelog:
  - Including the FIPS module was causing FIPS mode to be enabled by default.
    This had high potential for causing issues, as evidenced by our acceptance
    tests, so we now mirror the 'enabled' state of the module based on whether or
    not FIPS is already enabled on the target system.
  - Update puppet dependency in metadata.json


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.2.0-0
changelog:
  - Added support for OEL and Puppet 5
  - Add a message to the reboot_notify resource to be more helpful


author: Nick Miller <nick.miller@onyxpoint.com> - 0.2.0-0
changelog:
  - Added $dracut_ensure, $fipscheck_ensure and $nss_ensure parameters
    - Changed the packages from 'latest' to 'installed'
    - It will also respect `simp_options::package_ensure`
  - Update badges and contribution guide URL in the README.md


author: Chris Tessmer <chris.tessmer@onyxpoint.com> - 4.2.0-6
changelog:
  - Replaced all 'lsb*' facts with their (package-independent)
    'operatingsystem*' counterparts.
  - Common module assets have been normalized.
  - Fixed a bug with the radius_rsync_user passgen.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 5.0.0-0
changelog:
  - Ensure Puppet 4 compatibility. This changes the (always incorrect, but
    allowed) '2' and '3' paths to 'v2' and 'v3'.
    - Be sure to check and update your Hiera data!
  - Fixed the case where the `radius_version` fact does not exist.


author: Nick Markowski <nmarkowski@keywcorp.com> - 7.0.0-0
changelog:
  - Updated global catalysts
  - Refactored module
  - Application certs now managed in /etc/pki/simp_apps/freeradius/x509


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 8.0.0-0
changelog:
  - Refactored API
  - Strong typed all variables and updated functions for puppet 5 compatability.
  - Removed support for freeradius version 2 and CentOS 6.
  - Inner-tunnel site is not added by default any more.
  - Added check for FIPS mode and fail if server is in FIPS mode.
  - Created ldap site and module to be used to integrate freeradius
    with ldap server.  Instructions for use are in the README.
  - SQL sites are not added by default.
  - Update the upper bound of stdlib to < 6.0.0
  - Added acceptance and spec tests


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 8.0.1-0
changelog:
  - Updated documentation
    - Cleaned up for `puppet strings`
    - Added REFERENCE.md
    - Updated README.md
  - Switched all FIPS checks to use top level inherited checks
  - Add Puppet 6 support


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 7.0.0-0
changelog:
  - Changed calls to auditd to the new layout (breaking change)
  - Added acceptance tests
  - Ensure GDM starts at boot time on EL7
  - Add notice that two runs are required


author: Nick Miller <nick.miller@onyxpoint.com> - 7.0.1-0
changelog:
  - Added the following services on EL7:
    - `display-manager`
    - `upower` - replaced hal, used by gnome
    - `rtkit-daemon` - used by pulseaudio and gdm


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 7.1.0-0
changelog:
  - Moved the default banner selection to `simp_banners`
  - Added support for setting dconf options for GDM
  - Moved package list to data in modules for easy merging and overwriting
  - Added acceptance tests that go through the stages of setting up both
    GDM and GNOME for inspection
  - Update version range of auditd dependency in metadata.json


author: Nick Miller <nick.miller@onyxpoint.com> - 6.0.3-0
changelog:
  - Updated polkit setting to use the new defined type from the polkit module
  - Added polkit dependency
  - `dconf update` execs now catch failures


author: Nick Miller <nick.miller@onyxpoint.com> - 6.0.3-0
changelog:
  - Moved the simp dconf profile below the user profile so users can change
    their own settings in the desktop
  - Confine puppet version in metadata.json


author: Nick Miller <nick.miller@onyxpoint.com> - 7.0.0-0
changelog:
  - module was rewritten
    - takes advantage of the data in modules paradigm
    - has a single point of entry
  - packages now default to 'installed' or the package_ensure catalyst
    from simp_options
  - gnome::dconf::add
    - deprecated in favor of gnome::config::dconf
    - this class is now a temporary shim to ensure backwards compatibility
  - gnome::config::dconf
    - allows setting more than one key/value pair (only one could be set
      in dconf::add)
    - class name is not a verb
    - dconf settings controlled by this class can be modified in data,
      including removing default settings


author: Liz Nemsick <lnemsick.simp@gmail.com> - 7.0.1-0
changelog:
  - Add libxkbcommon-x11 to required package list for CentOS/RedHat 7.4.
  - Remove unnecessary CentOS data-in-module files.  The OS family fact
    for CentOS is RedHat, so these files are not used.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 8.0.0-0
changelog:
  - Removed all GDM and Dconf settings - BREAKING
    - Dconf has been moved to its own module
  - Ensure that all settings are 100% GNOME specific
  - Fixed a typo in the `dconf_hash` where `automount-never` was specified
    instead of `autorun-never`
  - Add support for OEL and Puppet 5


author: Trevor Vaughan <tvaughan@onyxpoint.com>
changelog:
  - Massive Refactor
  - Refactored the module to use the latest best practices and eliminate issues
    with doing an 'include' of the individual sub-classes.
  - Worked around a bug with the yum provider and the 'purged' parameter
  - Fixed some class ordering
  - Added acceptance tests for EL6 and EL7
  - Updated the rspec tests to properly work around OEL issues with facts


author: Nick Markowski <nmarkowski@keywcorp.com> - 0.3.1-0
changelog:
  - Updated module for auto lua spec generation
  - Added missing requires file and added dependency on simplib
  - Modified module to auto-generate lua spec


author: Liz Nemsick <lnemsick.simp@gmail.com> - 0.5.0-0
changelog:
  - Remove Puppet 4 support
  - Add Puppet 6 support
  - Add puppetlabs-stdlib 6 support
  - Maintenance: removed OBE build/rpm_metadata/requires


author: Michael Morrone <michael.morrone@onyxpoint.com> - 0.1.1
changelog:
  - Removed the HIRS package dependency list that was in common.yaml,
    as the HIRS RPM now appropriately specifies its dependencies.
  - Removed the softlink in the install manifest, because it is no longer
    needed with the newer HIRS package.
  - Updated the upper bound of puppet and stdlib to < 7.0.0
  - Updated RPMs for installation and testing
  - Updated Travis and GitLab Test matrices


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 0.2.0-0
changelog:
  - Fixed permission on incrond service file to clear errors in system log.
  - Updated package to use package ensure to control updates.  This changed the
    default ensure of package to installed from latest.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.3.0-0
changelog:
  - Added a native type `incron_system_table` to allow for client side glob
    expansion on paths
  - Pushed all validation of parameters off to the native type from
    `incron::system_table`
  - Updated acceptance tests to verify that incron is actually working
  - Bumped the supported puppet version to '< 6'


author: Nick Miller <nick.miller@onyxpoint.com> - 0.3.0-0
changelog:
  - Stop managing the systemd unit file, because deviating from the RPM defaults
    violates the STIG
  - Set /etc/incron.d to 0755, the RPM default


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.4.0-0
changelog:
  - Add the ability to set the 'max_open_files' ulimit
  - Add Incron::Mask Data Type denoting valid incron masks
  - Add `incron::purge` parameter to optionally delete all unmanaged files in
    `/etc/incron.d`. This may be enabled by default in the future but is
    currently disabled to preserve the existing functionality.
  - Added support for the new options starting with 0.5.12
    - Automatically strip out options that are not supported by earlier versions
      for seamless backward compatibility


author: Liz Nemsick <lnemsick.simp@gmail.com> - 0.4.1-0
changelog:
  - Fixed a bug in the incrond_version fact in which an error message
    was displayed during fact resolution, on systems for which incron
    was not installed.
  - Expanded the upper limits of the concat and stdlib Puppet module versions


author: Liz Nemsick <lnemsick.simp@gmail.com> - 5.0.0-0
changelog:
  - Fixed bug in the set provider for the xt_recent type that required manual
    modifications to the permissions for the /sys/module/xt_recent/parameters/*
    files, in order for the scanblock capability to be enabled.
  - Fixed bugs in the xt_recent type and its set provider that caused
    Puppet to believe /sys/module/xt_recent/parameters/ip_list_perms
    file content had changed when it had not.
  - Eliminated use of deprecated Puppet.newtype
  - Updated to compliance_markup version 2


author: Brandon Riden <brandon.riden@onyxpoint.com> - 6.0.2-0
changelog:
  - Added a workaround for Puppet 4.10 type issues
    - There was a bug in Puppet where all lookup() Hash keys were being converted
      into Strings even if they were another data type
    - This is fixed in Puppet > 4.10.2 but this patch will remain for backwards
      compatibility
  - Update puppet dependency in metadata.json
  - Remove OBE pe dependency in metadata.json


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.1.0-0
changelog:
  - Added the ability to ignore interfaces using the 'ignore' regex array
  - Fixed issues with ignoring rules and added some optimization
  - No longer apply IPTables rules in the optimization phase and simply wait for
    the downstream service to trigger


author: Some Dude <7zbayf+sw1l67jjhlbk@sharklasers.com> - 6.1.0-0
changelog:
  - Fixed a bug in the order of the IPTables rules in scanblock module
    - Previously, IPTables would not block connections from banned IPs that
      were accessing open ports.


author: Nick Miller <nick.miller@onyxpoint.com> - 6.1.1
changelog:
  - This commit moves the logic that parses the `iptables::ports` Hash into a
    define, to make it possible to use the same hash format in other modules
    without copying code.
  - There was also a bug where compilation would fail if `proto` was specified in
    the defaults section of the Hash.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.1.1
changelog:
  - Fixed bugs in the chain retention and optimization code that would cause
    iptables to fail to reload in some situations.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.1.3
changelog:
  - Fix issue where a `jump` target went to an empty ruleset and the chain was
    dropped
  - Retain all native IPTables jump points by default
  - Add `==` method for IPTables Rulesets


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.1.5
changelog:
  - Perform deep rule comparison on rulesets that are otherwise identical
  - Remove chances for memory leaks due to the design of iptables_rule
  - Set init script permissions back to the RPM defaults of 0755


author: Nick Miller <nick.miller@onyxpoint.com> - 6.1.6
changelog:
  - Changed $package_ensure from 'latest' to 'installed'
    - It will also respect `simp_options::package_ensure`


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.2.0
changelog:
  - Fixed bug in which port ranges specified by
    iptables::listen::tcp_stateful::dports or iptables::listen::udp::dports
    could be erroneously split over multiple iptables rules
  - Replaced deprecated simplib Puppet 3 function slice_array with
    iptables::slice_ports


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.2.0
changelog:
  - Added 'iptables_default_policy' for modifying the default policy of the
    'filter' table on either IPv4 or IPv6.
  - Added 'iptables::rules::default_drop' to allow users to easily toggle the
    default drop behavior of the default filter policies.
  - Removed Puppet 4 support
  - Added Puppet 6 support


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.0.3-0
changelog:
  - Removed the static banners from the module and tied the module to the
    `simp/simp_banners` module
  - Add support for OEL and Puppet 5


author: Liz Nemsick <lnemsick.simp@gmail.com> - 0.0.3-0
changelog:
  - Update static assets
  - Update to onyxpoint OEL boxes in acceptance tests
  - Update badges in README.md


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 4.1.0-2
changelog:
  - Updated to support the new LDAP options in Hiera properly.
  - Support using all LDAP servers in failover mode.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 4.1.0-4
changelog:
  - Updated to properly handle the SSL protocols in Apache. We now add a
    + if one is warranted and just keep the entry if it starts with a +
    a minus or is 'all'.


author: Nick Markowski <nmarkowski@keywcorp.com> - 6.0.0-0
changelog:
  - Updated global catalysts
  - Strong typed
  - Updated pki scheme; application certs now managed in
    /etc/pki/simp_apps/jenkins/x509


author: Nicholas Markowski <nicholas.markowski@onyxpoint.com> - 1.0.0-0
changelog:
  - Forked from cristifalcas/puppet-journald
  - Removed default options from API
  - Added SIMP assets
  - Updated Puppet dependency for hiera v5 support
  - Added inifile dependency in metadata, and updated stdlib version dependency
  - Initial release


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 5.0.2-0
changelog:
  - Fixed a bug in the krb5kdc_auto_keytab provider where passed hosts were not
    getting the realms array integrated.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 7.0.2-0
changelog:
  - Update custom Puppet 3 functions to namespaced, Puppet 4 functions
  - Fix most of the puppet strings problems
  - Update puppet requirement and remove OBE pe requirement in metadata.json


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 7.0.3-0
changelog:
  - Allow users to modify the owner, group, and mode of files that may be used by
    multiple subsystems


author: Nick Miller <nick.miller@onyxpoint.com> - 7.0.4-0
changelog:
  - Changed the packages from 'latest' to 'installed'
  - Ensure parameters will also now respect `simp_options::package_ensure`


author: Liz Nemsick <lnemsick.simp@gmail.com> - 7.0.5-0
changelog:
  - Use simplib::passgen() in lieu of passgen(), a deprecated simplib
    Puppet 3 function.
  - Use simplib::validate_re_array() in lieu of validate_re_array(),
    a deprecated simplib Puppet 3 function.
  - Removed unnecessary use of validate_port() on parameters of type
    Simplib::Port
  - Update the upper bound of stdlib to < 6.0.0
  - Update a URL in the README.md


author: Liz Nemsick <lnemsick.simp@gmail.com> - 1.0.0-0
changelog:
  - Added support for CentOS 6
  - Fix several bugs in the following categories:
    - Use of wrong variables (cut and paste errors or typos)
    - Improper parameter validations
    - Parameters not being used in erb files.
    - OBE names of ipsec settings.
    - Missing quotes/braces around settings that can contain whitespace
  - Expose more ipsec settings.
  - Allow IPv6 addresses


author: Liz Nemsick <lnemsick.simp@gmail.com> - 3.0.2-0
changelog:
  - Bug fixes:
    - Set up FIPS-compliant configuration, not just when
      simp_options::fips is true, but also when the server is already
      in FIPS mode.
    - Insert token password into the NSS database after configuring
      the NSS database for FIPS.
  - Updated the tests.


author: Chris Tessmer <chris.tessmer@onyxpoint.com> - 4.1.1-0
changelog:
  - Replaced all 'lsb*' facts with their (package-independent)
    'operatingsystem*' counterparts.
  - Common module assets have been normalized.


author: Nick Miller <nick.miller@onyxpoint.com> - 5.0.1-0
changelog:
  - Strongly typed module
  - Moved docs to strings/yardoc format
  - Removed verb from vm_create class to vm


author: Nick Miller <nick.miller@onyxpoint.com> - 5.1.0-0
changelog:
  - Use kmod::load instead of ruby script for loading the kernel module
  - Modernize some code
    - Moved all parameters to init.pp while also
      maintaining previous functionality
  - Spec test cleanup
  - New acceptance test (no nested virtualization)
  - Corrected some documentation and examples


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 5.1.0-0
changelog:
  - Added a `libvirt_br_netfilter_loaded` fact to determine if the `br_netfilter`
    kernel module is loaded on the target system
  - Documentation update
  - Data in modules update
  - Use `ensure_packages` for package installation
  - Fully decouple `libvirt::ksm` from the main `libvirt` class


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 5.1.0-0
changelog:
  - Added a `libvirt_br_netfilter_loaded` fact to determine if the `br_netfilter`
    kernel module is loaded on the target system
  - Documentation update
  - Data in modules update
  - Use `ensure_packages` for package installation
  - Fully decouple `libvirt::ksm` from the main `libvirt` class
  - Add support for Puppet 5 and OEL


author: Liz Nemsick <lnemsick.simp@gmail.com> - 5.2.1-0
changelog:
  - Update the upper bound of stdlib to < 6.0.0
  - Workaround a change in behavior of ensure_packages with stdlib 5.x.
    This change caused resource conflicts.
  - Update a URL in the README.md


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 4.0.0-8
changelog:
  - Fixed a typo whereby 'include' statements were not processed due to
    extraneous double quotes.
  - Moved the tabooext option outside of the main option set since, according to
    the docs, it simply overwrites or appends to the previous value anyway.


author: Kendall Moore <kmoore@keywcorp.com> - 4.1.0-0
changelog:
  - Refactored to pass all lint tests and be compatible with hiera and puppet 3.
  - Added rspec tests for test coverage.


author: Nick Markowski <nmarkowski@keywcorp.com> - 6.1.0-0
changelog:
  - Added lastaction logic to logrotate::rule.
  - Update puppet requirement and remove OBE pe requirement in metadata.json


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 6.1.1-0
changelog:
  - Updated the defaults  settings for compress, rotate and dateext in rule.pp
    to pull values from init.pp. (They were hard coded to them before)
  - changed templates to add nodateext if dateext is set to false.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.2.0-0
changelog:
  - Move SIMP-specific logrotate rules to a SIMP-managed configuration
    directory, /etc/logrotate.simp.d, and ensure logrotate processes
    that directory first. This ensures SIMP rules take priority, when
    duplicate rules are specified.


author: Nick Miller <nick.miller@onyxpoint.com> - 6.3.0-0
changelog:
  - Added OEL and Puppet 5 support
  - Add some previously impossible to configure options
    - the hourly rotate period
    - dateyesterday
    - shred and shredcycles
    - su and su_user and su_group (inapplicable on EL6)
  - Added Logrotate::Periods type alias which allows hourly rotation


author: Maintenance
changelog:
  2.0.0-4
  - Moved mit-tests to /usr/share/simp...
  - Updated pp files to better meet Puppet's recommended style guide.


author: Nick Markowski <nmarkowski@keywcorp.com> - 2.3.1-0
changelog:
  - Module forked from voxpupuli/puppet-mcollective
    (https://github.com/voxpupuli/puppet-mcollective)
  - Added in mco_autokey generation.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 2.4.0-0
changelog:
  - Update to the 2.2.0 release of the voxpupuli module
  - Updated mcollective::defaults to insert the RPM-compatible core_libdir if
    using a RedHat family system


author: Nick Markowski <nmarkowski@keywcorp.com> - 3.0.0-0
changelog:
  - SIMP-2133: Ensured capabilities synced with 5.X, master.
  - SIMP-2133: Gemfile updated to use latest assets.
  - SIMP-1595: Updated dependency boundaries.
  - SIMP-2097: Bumped major version to 3.0.0.


author: Maintenance
changelog:
  2.0.0-3
  - Moved mit-tests to /usr/share/simp...
  - Updated pp files to better meet Puppet's recommended style guide.


author: Maintenance
changelog:
  2.0.0-4
  - Created a Cucumber test to ensure that firefox installs correctly
    and is at the latest version when including mozzila in the puppet
    server manifest.


author: Nick Miller <nick.miller@onyxpoint.com> - 5.1.0-0
changelog:
  - Added $package_ensure parameters to mozilla::firefox and mozilla::thunderbird
    - Changed the package from 'latest' to 'installed'
    - Each package ensure parameter will also respect `simp_options::package_ensure`
    - Removed the architecture qualifier from the name of each package resource


author: Chris Tessmer <chris.tessmer@onyxpoint.com> - 4.2.0-8
changelog:
  - `named::non_chroot` will now intentionally fail (with an informative message)
    if included when selinux is not enforcing


author: Nick Markowski <nmarkowski@keywcorp.com> - 4.3.0-0
changelog:
  - Created work-around for https://bugzilla.redhat.com/show_bug.cgi?id=1278082
  - Users can modify the chroot path in named-chroot.service
  - Asserted service, chroot, and non-chroot as private classes


author: Nick Miller <nick.miller@onyxpoint.com> - 4.3.1-0
changelog:
  - Changed the Exec['restart-systemd'] to Exec['systemctl-daemon-reload']
    to avoid a conflict with puppetlabs-postgresql


author: Lucas Yamanishi <lucas.yamanishi@onyxpoint.com> - 4.3.3-0
changelog:
  - This patch corrects the following shortcomings to ensure compatability
    with Red Hat Enterprise Linux 7 and its clones:
      - Ensures all required directories exist in the chroot
      - Remove dependencies for the non-existent `named-chroot-setup.service`
      - Use new-style daemon invocation, executing in the foreground and
        logging to stderr.  See daemon(7).
      - Since new-style daemons don't require a PID file, nor does the binary
        generate one in foreground mode, remove it from the service file.


author: Nick Markowski <nmarkowski@keywcorp.com> - 6.0.0-0
changelog:
  - Updated global catalysts and strong typed the module
  - Made chrooting logic less complicated
  - ALL of the spec tests


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.0.3-0
changelog:
  - Provide override file for named-chroot.service instead of
    modifying the vendor-provided service file.
  - Use simplib::assert_metadata() for OS validation
  - Replace Puppet3 version of passgen() with  simplib::passgen()


author: Nick Miller <nick.miller@onyxpoint.com> - 6.1.0-0
changelog:
  - Changed $named::install::ensure from 'latest' to 'installed'
    - It will also respect `simp_options::package_ensure`


author: Chris Tessmer <chris.tessmer@onyxpoint.com> - 4.1.0-6
changelog:
  - Replaced all 'lsb*' facts with their (package-independent)
    'operatingsystem*' counterparts.
  - Common module assets have been normalized, lint errors corrected,
    and rspect tests have been updated to the new 'expect' syntax.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 4.1.2-0
changelog:
  - Ensure that no calls to 'function_defined' are present in any templates for
    Puppet 4 compatibility


author: Nick Miller <nick.miller@onyxpoint.com> - 6.0.0-0
changelog:
  - Strong typing w/new IP types
    - All parameters that were 'yes' or 'no' are now optional booleans
  - Removed most validation from templates
  - Added more tests for all manifests
  - Cleaned up regex in the careful restart script


author: Nick Miller <nick.miller@onyxpoint.com> - 6.0.2-0
changelog:
  - Added management of bind-utils and bridge-utils
    - Packages in this module now use the package_ensure catalyst
  - Update puppet requirement in metadata.json


author: Jeanne Greulich <jeanne,greulich@onyxpoint.com> - 6.0.3-0
changelog:
  - Static asset updates for puppet 5
  - Update badges and contribution guide URL in README.md
  - Update to onyxpoint OEL boxes in acceptance tests


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.0.4-0
changelog:
  - Use Simplib::Macaddress data type in lieu of validate_macaddresses(),
    a deprecated simplib Puppet 3 function.
  - Update the upper bound of stdlib to < 6.0.0
  - Update a URL in the README.md


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.1.0-0
changelog:
  - Ensure that the acceptance tests pass and bring up the bridge device
  - Fix the fact that network::global could break networking
  - Expose failures during Exec's of network-related activity
  - Add NetworkManager support


author: Nick Markowski <nmarkowski@keywcorp.com> - 4.5.2-0
changelog:
  - Defaulted export sec to sys.
  - Updated documentation to reflect krb5 integration with manual changes.


author: Nick Markowski <nmarkowski@keywcorp.com> - 6.0.0-0
changelog:
  - Updated global catalysts and strong typed.
  - Fix bug whereby the STATDARGS parameter in NFS sysconfig server
    configuration was not set.
  - Fix bug whereby the LOCKD_ARG parameter in NFS sysconfig server
    configuration was improperly set.


author: Nick Markowski <nmarkowski@keywcorp.com> - 6.0.3-0
changelog:
  - gssproxy ensured running when secure_nfs is true, el > 7.1
  - Confine puppet version in metadata.json


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.1.0-0
changelog:
  - Changed all stunnel connections to use 'stunnel::instance' methods so that
    they are not interrupted by an issue with the global stunnel configuration
    and they can set the TCP_NODELAY option as suggested for small transaction,
    high bandwidth connections.
  - Added parameters to allow users to tweak the stunnel socket options for all
    NFS stunnel connections.


author: Nick Miller <nick.miller@onyxpoint.com> - 6.1.1-0
changelog:
  - On systemd systems, the stunnel service is now a dependency of the NFS
    servers and mounts managed by this module.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.1.1-0
changelog:
  - Added `nfs::client::mount::autodetect_remote` to override all autodetection
    of whether or not the remote host was the current NFS server so an NFS
    server can mount NFS directories from other servers.
  - Added `nfs::client::mount::stunnel` to allow users to dictate the stunnel
    connection state for specific mounts.


author: Nick Miller <nick.miller@onyxpoint.com> - 6.1.1-0
changelog:
  - Update systemd fixtures and CI assets
  - Add logging for exportfs failures
  - Ensure that reexports happen after the NFS service has been started


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.1.0-0
changelog:
  - Changed all stunnel connections to use 'stunnel::instance' methods so that
    they are not interrupted by an issue with the global stunnel configuration
    and they can set the TCP_NODELAY option as suggested for small transaction,
    high bandwidth connections.
  - Added parameters to allow users to tweak the stunnel socket options for all
    NFS stunnel connections.
  - Added support for OEL and Puppet 5


author: Nick Miller <nick.miller@onyxpoint.com> - 6.2.0-0
changelog:
  - Added OEL and Puppet 5 support
  - Change rpcbind service name on EL7 from `rpcbind.socket` to,
    `rpcbind.service`, but only on EL7.4+
  - Changed all packages ensure parameter from 'latest' to 'installed'
    - They also respect `simp_options::package_ensure`
    - Added $nfs::install::tools_ensure and $nfs::lvm2::ensure


author: Jeanne Greulich <jeanne,greulich@onyxpoint.com> - 6.2.0-0
changelog:
  - Update static assets for puppet 5
  - Update to onyxpoint OEL boxes in acceptance tests
  - Update badges and contribution guide URL in README.md


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.2.1-0
changelog:
  - Expanded the upper limit of the concat and stdlib Puppet module versions
  - Updated URLs in the README.md


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 4.1.0-8
changelog:
  - Updated the default restrict options to be more restrictive.
  - Ref: https://access.redhat.com/articles/1305723


author: Nick Miller <nick.miller@onyxpoint.com> - 6.1.0-0
changelog:
  - Manage ntpdate via `ntpd::ntpdate`
    - Manage `/etc/ntp/step-tickers`
    - Manage `/etc/sysconfig/ntpdate`
      - New params ntpdate_sync_hwclock, ntpdate_retrym and ntpdate_options should
        cover all options from RedHat
      - `SYNC_HWCLOCK=yes` is now set here instead of `/etc/sysconfig/ntp`
  - Add `$package_ensure` parameter to control the `ntp` package version
  - Move some multiline strings into variables (style recommendation)
  - The module now only requires one puppet run to apply completely
  - Added essential-level acceptance test


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.1.1-0
changelog:
  - Fixed bug in which ntpd::ntpd_options was not applied to ntpd::servers
    when ntpd::servers is an array.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.3.0-0
changelog:
  - Expanded the upper limit of the concat and stdlib Puppet module versions
  - Updated a URL in the README.md


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.3.0-0
changelog:
  - Validated Puppet 6 support
  - Ensure that users can change the default 'restrict' parameters
  - Allow users to add arbitrary extra content to the ntpd.conf
  - Allow users to define the entire ntpd.conf content


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.4.0-0
changelog:
  - Drop Puppet 4 support
  - Add ability for users to enable a default server capability directly from
    Hiera
  - Fix minor typos in some templates
  - Add REFERENCE.md


author: Zach <turtles.be.the.best@gmail.com> - 0.1.0-0
changelog:
  - Added pam_oath.so configuration code
  - Added strict type matching of oath::oath_users hieradata
  - Created Rspec tests checking correct catalog creation
  - Skeleton acceptance test created (and working)
  - Updated documentation to reflect current state of the module


author: Nick Miller <nick.miller@onyxpoint.com> - 2.1.0-0
changelog:
  - Added $package_ensure and $oddbob::mkhomedir::package_ensure parameter
    - Changed the packages from 'latest' to 'installed'
    - It will also respect `simp_options::package_ensure`


author: Liz Nemsick <lnemsick-simp@gmail.com> - 2.1.0-0
changelog:
  - Update to onyxpoint OEL boxes in acceptance tests
  - Update badges and contribution guide URL in README.md


author: Liz Nemsick <lnemsick-simp@gmail.com> - 2.1.1-0
changelog:
  - Remove unnecessary use of validate_umask(), a deprecated simplib
    Puppet 3 function.
  - Update the upper bound of stdlib to < 6.0.0
  - Update a URL in the README.md


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 4.2.0-0
changelog:
  - Moved set_schedule to just schedule
  - Updated for the native release of OpenSCAP and the SCAP Security Guide as
    include in RHEL6.6 and higher.


author: Brandon Riden <brandon.riden@onyxpoint.com> - 6.0.3
changelog:
  - Changed Openscap::Profile type to use regex match on profiles rather than the Enum.
  - Added hieradata to module to specify scap_profile and ssg_data_stream based
    on OS (RedHat 6, RedHat 7, CentOS 6, and CentOS 7)


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.1.0-0
changelog:
  - Added an `oscap` fact for gathering the following information:
    - OpenSCAP Version
    - OpenSCAP Supported Specifications
    - SCAP Profiles from /usr/share/xml/scap/*/content/*-ds.xml
  - Added logic to ensure that a valid profile is chosen based on the new fact
  - Added unit and acceptance tests
  - Updated data to reflect valid choices on a default EL6 load


author: Nick Miller <nick.miller@onyxpoint.com> - 6.2.0-0
changelog:
  - Add package_ensure parameters to packages managed by this modoule
    - $scap_ensure - openscap-utils
    - $ssg_ensure - scap-security-guide
  - Add missing $scap_tailoring_file parameter to openscap::schedule


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 4.2.5-0
changelog:
  - Update to pam_pwhistory.so to fix local user login failures due to SELinux
    policy updates affecting /etc/security/opasswd in EL7.


author: Nick Miller <nick.miller@onyxpoint.com> - 5.0.1-0
changelog:
  - Added a generic content option to replace all templated PAM configurations
    - Setting use_templates to false will enable them


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 6.0.0-0
changelog:
  - corrected error for lookup
  - Fixed comments and aligned variables to make it look pretty.
  - update simplib version to include new types.
  - renamed pam::access::manage to pam::access::rule
  - renamed pam::limits::add to pam::limits::rule
  - Added strong types and updated Global catalists.
  - Removed NSCD logic.


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 6.0.0-0
changelog:
  - When using list separator  you can't have spaces between
    identifiers in access.conf if your separator is not a space. 
    It then includes spaces as part of the name so we are removing spaces
    from the access file.  Dylan also added changes that wrap the use 
    of separator in boolean.


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 6.0.0-0
changelog:
  - When using list separator  you can't have spaces between
    identifiers in access.conf if your separator is not a space.
    It then includes spaces as part of the name so we are removing spaces
    from the access file.  Dylan also added changes that wrap the use
    of separator in boolean.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.2.0-0
changelog:
  - Set the minimum UID allowed onto the system to the default defined in
    /etc/login.defs or 1000 if not otherwise defined


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.2.0-0
changelog:
  - Replace authconfig and authconfig-tui links to a no-op script, instead
    of removing them.  This does not break tools that use authconfig.
  - Use simp_options::package_ensure, when available


author: Adam Yohrling <adam.yohrling@onyxpoint.com> - 6.2.0-0
changelog:
  - Update the pam::unlock_time parameter to accept 'never' as a value per the
    man page and in accordance with the DISA STIG


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.2.1-0
changelog:
  - Allow users to change the password hash algorithm
  - Allow users to enable/disable enforcing password policies for `root`
  - Update compliance tests to work with inspec profiles and compliance engine
    enforcement.


author: Nicholas Markowski <nicholas.markowski@onyxpoint.com> - 6.4.0-0
changelog:
  - Added pam::access::access_file_mode parameter to allow users to manage
    access.conf file permissions
  - Updated lower bound on stdlib to 4.22.0 to add Filemode strong type support


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.5.0-0
changelog:
  - Fix bug where the ending faillock items were not being called due to the
    'sufficient' lines on pam_unix and pam_sssd.
  - Add option to allow users to disable faillock if desired
  - Fix bug where 'authsucc' was not set at the end of the 'auth' section for
    faillock (SIMP-6306)
  - Update all comments for puppet strings
  - Converted all templates to EPP for performance
  - Fully updated the README


author: Jeanne Greulich <jgreulich.greulich@onyxpoint.com> - 6.0.0-0
changelog:
  - Global catalyst updates
  - Strong Type updates
  - Changed default for pki directory to /etc/pki/simp from /etc/pki


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.0.0-0
changelog:
  - Changed pki::pki_dir parameter to pki::base_dir
  - Updated acceptance tests
  - Fixed bugs in ordering


author: Nick Markowski <nmarkowski@keywcorp.com> - 6.0.0-0
changelog:
  - Set perms on simp_apps to 644/755; apps were being denied access to
    their own certs because they could not access /etc/pki/simp_apps.
  - We have made the decision to centralize application certificates
    when simp is managing pki (simp_options::pki => true or 'simp').
    This update re-tools pki::copy to better handle managing certs
    in /etc/pki/simp_apps.


author: Nick Miller <nick.miller@onyxpoint.com> - 6.0.0-0
changelog:
  - Changed default location of keydist certs from the files directory of the pki
    module unless $pki is set to 'simp', when it will pull from pki_files in a
    different module path instead.


author: Nick Markowski <nmarkowski@keywcorp.com> - 6.0.0-0
changelog:
  - SIMP certs are now managed in /etc/pki/simp/x509, and application
    certs in /etc/pki/simp_apps/<app_name>/x509.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.0.2-0
changelog:
  - Ensure that /etc/pki/simp_apps is recursively purged so that old certificates
    are not left on the system
  - Adds a new param, `$certname`, that controls the name of the certs in keydist
    that will be copied over. This used to be set to `$facts['fqdn']` without an
    option to change it, now it will default to `$trusted['certname']`


author: Nick Miller <nick.miller@onyxpoint.com> - 6.0.3-0
changelog:
  - pki::copy's source parameter now accepts any string to allow for use of NSS
    and remote file sources.
  - Cleanup unneeded fixtures
  - Update version range of auditd dependency in metadata.json


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.1.0-0
changelog:
  - pki_cert_sync type now generates an aggregate CA certificates
    with X.509 certificate headers removed, cacerts_no_headers.pem,
    in addition to the existing aggregate CA certificates file,
    cacerts.pem. This new CA certificates file is useful for
    application that cannot handle certificate headers.
  - Add a pki_cert_sync option, ``generate_pem_hash_links``, which controls
    whether pki_cert_sync should generate and maintain the PEM file hash
    links in the target directory. Disabling automatic PEM hash link
    generation is useful if an application is managing those links
    in the target directory, itself.
  - Update the upper bound of stdlib to < 6.0.0
  - Update a URL in the README.md


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.1.1-0
changelog:
  - Moved temporary aggregate CA certs reference files used by
    pki_cert_sync out of the target directory. These temporary
    files were being erroneously processed by the gitlab
    application.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 4.0.0-2
changelog:
  - There was a bug in the 'identity' variable for polkit::local_authority where
    it would not properly accept arrays of users or groups.


author: Kendall Moore <kmoore@keywcorp.com> - 4.1.0-0
changelog:
  - Refactored manifests to pass all lint tests for puppet 3 and hiera compatibility.
  - Added spec tests.


author: Nick Miller <nick.miller@onyxpoint.com> - 6.1.0-0
changelog:
  - Add EL7 and polkit 106+ support by allowing javascript rules
    - Added define to allow for easy placement of custom rules
    - Added templated define to ease generation of basic rules


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.1.0-0
changelog:
  - Update custom Puppet 3 functions to namespaced, Puppet 4 functions
  - Allow default identity and identities prefixed with unix-netgroup.
  - Confine puppet version in metadata.json


author: Nick Miller <nick.miller@onyxpoint.com> - 5.0.2-0
changelog:
  - Removed `audit` metaparameter
  - Implemented `package_ensure` catalyst
  - Cleaned up some code formatting
  - Update puppet requirement and remove OBE pe requirement in metadata.json


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 5.1.0-0
changelog:
  - Added main_cf_hash parameter so a list of additional settings for main.cf
    file can be added without the need for entering a resource for each one.
  - Added the smtpd_client_restrict entry to main.cf per the STIG.
  - Updated simpcat to concat.
  - Rearranged code into sub-classes to make it easier to follow.


author: Nick Miller <nick.miller@onyxpoint.com> - 5.1.0-0
changelog:
  - Avoid changing the permissions from the vendored RPM
    - /etc/postfix/* perms from 0640 to 0644
    - /usr/libexec/postfix management is no longer recursive
    - /var/spool/mail perms from 0755 to 0775
  - Cleanup unneeded fixtures and update CI assets


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 5.2.0-0
changelog:
  - Ensure that only IPv4 is used if IPv6 is disabled on the system
  - Add support for OEL and Puppet 5


author: Nicholas Markowski <nicholas.markowski@onyxpoint.com> - 5.2.0-0
changelog:
  - Updated $app_pki_external_source to accept any string. This matches the
    functionality of pki::copy.
  - Update badges and contribution guide URL in README.md


author: Trevor Vaughan <tvaughan@onyxpoint.com>, Chris Tessmer <chris.tessmer@onyxpoint.com> - 7.0.0-0
changelog:
  - Upate to work with the latest Puppet 4 and Puppet Server
  - Fixed a lot of tests and minor logic problems


author: Nick Miller <nick.miller@onyxpoint.com> - 7.1.0-0
changelog:
  - Updated assets and versions
  - Converted to puppet-strings
  - Switched to the new catalyst pattern with simplib::lookup
  - Strong typed module
  - Set trusted_server_facts to true by default


author: Liz Nemsick <lnemsick.simp@gmail.com> - 7.9.0-0
changelog:
  - Update minimum version of inifile Puppet module to 2.5.0
  - Fix dependency cycle in a full SIMP system that was introduced by
    the new autorequire of the parent directory of an INI file in the
    ini_setting type
  - Expanded the upper limit of the concat and stdlib Puppet module versions
  - Updated a URL in the README.md


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 7.9.0-0
changelog:
  - Add fact to list all the jruby jar files in the puppetserver installation
    directory.
  - Allow user to change the jar file used to run puppetserver via
    pupmod::master::sysconfig::jruby_jar.
  - Change the default jar file for puppetserver to jruby-9k.jar for
    the FOSS puppetserver.  (It is already set to that for PE.)


author: Nick Miller <nick.miller@onyxpoint.com> - 7.9.0-0
changelog:
  - Added Puppet 6 support
  - Add management of $ssldir and $rundir
  - Ensure that the puppet client environment is set to that which is provided by
    the server by default.


author: Bob Vincent <pillarsdotnet@gmail.com> - 7.11.0-0
changelog:
  - Ensure that the 'environment' setting in puppet.conf is forced into the
    'agent' section.
  - Ensure that the 'environment' setting in puppet.conf does not exist in the
    'main' section.
  - Fix ordering issues with managing the Puppet Server


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 7.11.0-0
changelog:
  - Add a pupmod::server_distribution function for more accurately determining
    the version of the puppet server installed on the target system.
  - Refactor some of the underlying code to use the new function and be safer for
    PE installations.


author: Nick Miller <nick.miller@onyxpoint.com> - 7.1.1-0
changelog:
  - The previous audit rules relied on the puppet user existing, but in
    newer versions of puppet, the puppet user only exists on the
    puppetserver. This commit only puts auditing on the puppetserver.


author: Nick Markowski <nmarkowski@keywcorp.com> - 7.2.0-0
changelog:
  - Updated puppetagent_cron:
  -  Added `break_puppet_lock` param so users can clearly specify when they wish
     to forcibly enable the puppet agent.
  -  Added `max_disable_time param`. Updated logic to determine when to
     forcibly enable a puppet agent, and moved logic into cron.pp for
     user-friendliness.
  -  Set maxruntime default of 4 hours


author: Dylan Cochran <dylan.cochran@onyxpoint.com> - 7.3.1-0
changelog:
  - Use global catalyst to configure package_ensure.
  - Add 'puppet_enterprise::profile::database' class definition to the pe_classlist
    and move the postgresql components under that class.
  - Add 'puppet_enterprise::profile::primary_master_replica' class definition
    to the class list to work around an issue in production


author: Kendall Moore <kendall.moore@onyxpoint.com> 7.3.1-0
changelog:
  - Added manifest to manage simp-specific puppet master auth requirements
  - Disabled puppetserver setting to enable legacy auth.conf by default
  - Remove legacy auth.conf placed by the `puppet-agent` package


author: Nick Markowski <nmarkowski@keywcorp.com> - 7.3.1-0
changelog:
  - Ensure legacy auth.conf is backed up before removing it. This is a
    follow up to SIMP-3049 based on feedback to SIMP-3196.


author: Nick Miller <nick.miller@onyxpoint.com> - 7.3.1-0
changelog:
  - Removed Puppet CRL download, the puppet agent now checks for the expiration of
    the cert automatically


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 7.3.1-0
changelog:
  - fixed the path to the pki_files and krb_files in the auth.conf
    so remote systems could download files.
  - Update puppet requirement in metadata.json


author: Nick Markowski <nmarkowski@keywcorp.com> - 7.4.0-0
changelog:
  - README updates:
    - Informed users of legacy auth.conf deprecation
    - Provided instructions to reproduce custom auth.conf entries
      in puppet


author: Liz Nemsick <lnemsick.simp@gmail.com> - 7.4.0-0
changelog:
  - Add SHA256-based option to generate the minute parameter for
    a client's puppet agent cron from its IP address. This option
    is intended mitigate the undesirable clustering of client puppet
    agent runs, when the number of IPs to be transformed is less
    than the minute range over which the randomization is requested
    (60) and/or the client IPs are not linearly assigned.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 7.5.0-0
changelog:
  - Updated to support Puppet 5
    - Fixed issues with the puppetserver configuration that could have broken
      Puppet 5 system configurations
    - Updated to support new server options
  - Fixed issues with autosign and fileserver.conf defined types generating
    incorrect files
  - Updated all puppet strings documentation
  - Converted all templates to EPP
  - Added process limits on the number of JRuby instances started designed to not
    overload the server in terms of either processor power or memory capabilities
  - Added OracleLinux support


author: Nick Miller <nick.miller@onyxpoint.com> - 7.5.0-0
changelog:
  - pupmod::master::simp_auth
    - Allow tweaking `allow` and `deny` rules for supported keydist auth rules
    - Removed Mcollective auth rules
    - Deprecated `$legacy_cacerts_all` and `$legacy_pki_keytabs_from_host`


author: Lucas Yamanishi <lucas.yamanishi@onyxpoint.com> - 7.5.0-0
changelog:
  - Fix service name and related resources on Puppet Enterprise (PE)
    - Fix `$tmpdir` setting on PE
    - Fix Puppetserver service management on PE


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 7.6.0-0
changelog:
  - Added line in puppet cron to shutdown/disable puppet client service.
  - Added check in agent/cron manifest to disable and stop puppet client service
    so it would not run multiple times on newly kickstarted systems.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 7.6.0-0
changelog:
  - Changed some 'validate_re' statements to 'assert_type' to remove deprecation
    warnings
  - Added 'pupmod::master::generate_types' (enabled by default) which:
    - Adds a script, /usr/local/sbin/simp_generate_types that will run 'puppet
      generate types' either on all environments (when first distributed by
      Puppet) or per environment
    - Adds incron hooks to run 'simp_generate_types' when Ruby files in any
      puppet type have been updated
    - Adds incron hooks to run 'simp_generate_types' on any new environment
    - Adds incron hooks to run 'simp_generate_types' on *all* environments if the
      puppetserver binary is updated
    - All errors are logged to syslog


author: Nick Miller <nick.miller@onyxpoint.com> - 7.6.1-0
changelog:
  - Cleanup unneeded fixtures and update CI assets
  - Remove unused simp/tcpwrappers and simp/logrotate dependencies


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 7.6.1-0
changelog:
  - Fixed the new `simp_generate_types` script to ensure that the permissions on
    the created directory are correctly set.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 7.6.1-0
changelog:
  - Fixed bug in which the JAVA tmpdir path for the puppetserver was
    incorrectly set.  This could cause puppetserver RPM upgrades to fail.


author: Steven Pritchard <steven.pritchard@onyxpoint.com> - 7.7.0-0
changelog:
  - Unconditionally manages the puppet service
  - Remove the (apparently) broken status logic on the puppet service


author: Chris Tessmer <chris.tessmer@onyxpoint.com> - 7.7.0-0
changelog:
  - Add `ensure` parameter to `pupmod::conf``
  - Ensure that `trusted_server_facts` is removed for Puppet 5.+ (PUP-6112)


author: Chris Tessmer <chris.tessmer@onyxpoint.com> - 7.7.0-0
changelog:
  - Remove deprecated `[master] ca` setting when `ca = true` in Puppet 5.5.6+
  - Remove `[master] ca` setting in Puppet 6+
  - Update badges and contribution guide URL in README.md


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 7.7.0-0
changelog:
  - Fix warning about automatic data type munging in the puppet server sysconfig
    template
  - Add workaround for Puppet 5 background exec issue to the generate_types exec


author: Brandon Riden <brandon.riden@onyxpoint.com> - 7.7.1-0
changelog:
  - Set pupmod::master::generate_types: enable => false by default to fix
    bug causing puppet servers to crash.


author: Brandon Riden <brandon.riden@onyxpoint.com> - 7.7.1-0
changelog:
  - Set pupmod::master::generate_types: enable => false by default to fix
    bug causing puppet servers to crash.
    - pupmod::master::extra_webserver_sections


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 7.8.0-0
changelog:
  - Fixed issues with incron rules and the simp_generate_types calls.
    - This was mostly due to bugs in the newer version of incrond. However, this
      module is now extensively tested for safety but will only trigger type
      generation on environment creation or updates to the puppet binaries.
  - Fix bug where some SSL settings could not be set for the puppet server
    `webserver` components.
  - Added the following *advanced usage* parameters in case users need to set
    parameters that are not presently managed to work around future issues:
    - pupmod::master::server_webserver_options
    - pupmod::master::ca_webserver_options


author: Nick Miller <nick.miller@onyxpoint.com> - 0.0.1
changelog:
  - Most of this content was from simplib
    - The dns autoconfiguation content was moved to a profile in simp/simp
  - First cut


author: Chris Tessmer <chris.tessmer@onyxpoint.com> - 0.1.0-0
changelog:
  - Improve validation for resolv.conf parameters
  - Add type aliases, epp with typed parameters
  - Update data types in init.pp parameter list (backwards compatible)
    - NOTE: The data type for the parameters `$resolv::servers` and
      `$resolv::search` has changed from `Simplib::Netlist` to Arrays with more
      specific requirements.  This has not been considered a breaking API change,
      since the original data types were too permissive and non-valid data would
      have either been ignored or broken name resolution.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.1.2-0
changelog:
  - Deprecate the 'resolv::host_conf::spoof' parameter since it does not have any
    actual effect on the system. See
    https://bugzilla.redhat.com/show_bug.cgi?id=1577265 for information.
  - Add official support for Puppet 6
  - Update URLs in the README.md
  - Update upperbound of stdlib


author: Joseph Sharkey <shark.bruhaha@gmail.com> - 0.0.1
changelog:
  - This is the initial code for a `pupmod-simp-rkhunter` module, which
    installs and configures rkhunter and unhide.


author: Nicholas Hughes <nicholasmhughes@gmail.com> - 4.2.2-0
changelog:
  - Updated the client_nets parameters to pull from global prior to using Hiera
    and to fall back to the safety of 127.0.0.1.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.0.0-0
changelog:
  - Switched to using puppetlabs/concat
  - Fixed the startup script for EL6
  - Fixed minor ordering issues
  - Renamed the service to 'rsyncd' to match the service name in EL7
  - Cleaned up rsyslog calls to remove logic


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.0.0-0
changelog:
  - Fixed minor bug in rsync provider that caused  'Unknown failure
    using insync_values?' Puppet message to be generated.


author: Adam Yohrling <adam.yohrling@onyxpoint.com> - 6.0.6-0
changelog:
  - Add `order => 'numeric'` setting to concat for rsyncd.conf
  - Add support for Puppet 5
  - Add support for and OEL


author: Nick Miller <nick.miller@onyxpoint.com> - 6.1.0-0
changelog:
  - Added $package_ensure parameter
    - Changed the package from 'latest' to 'installed'
    - It will also respect `simp_options::package_ensure`
  - Update badges and contribution guide URL in README.md


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.1.1-0
changelog:
  - Fixed a template bug that prevented catalogue compilation when
    rsync::server::section::user_pass was set
  - Use simplib::passgen() in lieu of passgen(), a deprecated simplib
    Puppet 3 function.


author: Adam Yohring <adam.yohrling@onyxpoint.com> - 6.1.1-0
changelog:
  - Modified class to support configuring SIMP rsync server and SIMP
    rsync client for same machine
  - Combine `rsync::server::global` with `rsync::server`
  - Add ability to use ports in rsync_server parameter


author: Steven Pritchard <steven.pritchard@onyxpoint.com> - 6.2.0-0
changelog:
  - Add v2 compliance_markup data
  - Remove puppet 4 support
  - Add puppet 6 support
  - Add puppetlabs-stdlib 6 support


author: Mike Renfro <renfro@tntech.edu> - 6.3.0-0
changelog:
  - Add 'preserve_perms' attribute to allow users to disable the preservation of
    server-side permissions.
  - If this flag is set to `false`, sets `chmod` to `u=rwX,g=rwX,o-rwx`


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 5.1.0-0
changelog:
  - Migrated to Semantic Versioning 2.0
  - Fixed a bug where the ability to use custom templates was omitted from the
    remote logging rules.
  - Ensure that all components of the module are pulled onto the system via the
    RPM.
  - Added support for the global $LocalHostName variable and set it to $::fqdn by
    default.
  - Updated RPM requirements


author: Nick Miller <nick.miller@onyxpoint.com> - 6.0.0-0
changelog:
  - Added a feature to read journald, enabled by defauly on systems with systemd.
  - Updated to use compliance mapper v2.0.0


author: Nick Markowski <nmarkowski@keywcorp.com> - 7.0.0-0
changelog:
  - Updated pki to use new scheme
  - Application certs now managed in /etc/pki/simp_apps/rsyslog/x509
  - Added trailing newline to drop rules


author: Nick Markowski <nmarkowski@keywcorp.com> - 7.0.3-0
changelog:
  - rsyslog::server::enable_selinux now optional, for robustness
  - Updated logrotate to use new lastaction API


author: Liz Nemsick <lnemsick.simp@gmail.com> - 7.0.3-0
changelog:
  - Fixed bug in which default iptables rsyslog rule did not work
    with rsyslog version 7.4.7.  Some versions of rsyslog include
    the ' ' separator in the message payload, which impacts the
    startswith rule.
  - Fixed bug whereby puppetserver log messages were not being
    collected in puppetserver-specific logs.
  - Update puppet requirement in metadata.json


author: Liz Nemsick <lnemsick.simp@gmail.com> - 7.1.0-0
changelog:
  - Add ability to specify full rule content for rsyslog::rule::local
    and rsyslog::rule::remote defined types.
  - Fixed bug in which ioBufferSize parameter was listed twice
    in the rsyslog rule generated by rsyslog::rule::local.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 7.1.2-0
changelog:
  - Add a systemd rsyslog.service override file that fixes a service
    ordering problem present with older versions of rsyslog.  The
    override ensures the network.target and network-online.target units
    are added to the 'Wants' and 'After' lists for the rsyslog.service.


author: ralph-wright <ralph.wright@onyxpoint.com> - 7.2.0-0
changelog:
  - Remove all ActionSendStreamDriver* directives from the global
    configuration, to allow individual actions to control their specific
    stream settings.  This change was required to allow a host which is
    itself a syslog server to receive TLS-encrypted data, but forward
    these messages to a different remote syslog server as unencrypted data.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 7.2.0-0
changelog:
  - Reinstated ActionSendStreamDriverMode directive into the global
    configuration when sending TLS-encrypted messages for Rsyslog
    7 version, only. The sending of TLS-encrypted messages for CentOS 6
    will not work otherwise.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 7.2.0-0
changelog:
  - Fixed a bug in which removal of a rsyslog::rule from the catalog
    did not cause the rsyslog service to restart, when other rules
    corresponding to files in the same rsyslog configuration
    subdirectory were present.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 7.3.0-0
changelog:
  - Updated the tests to no longer reference sudosh as our custom test since we
    are moving away from using it and it could cause confusion.


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> 7.3.0-0
changelog:
  - Updated rsyslog::rule::remote to select a more intelligent default
    for StreamDriverPermittedPeers, when TLS is enabled.  This improvement
    fixes the bug in which forwarding of logs to servers in different domains
    was not possible with the stream_driver_permitted_peers default.  Now,
    rsyslog::rule::remote::stream_driver_permitted_peers defaults to 'undef',
    instead of the domain of the Puppet client, and has the following default
    behavior:
    - When all of the remote servers are specified with hostname variants, the
      StreamDriverPermittedPeers directive for the forwarding action for each
      server will be set to that server's hostname.
    - If any of the remote servers is specified as an IP address variant, the
      StreamDriverPermittedPeers directive for the forwarding action for
      each server will be set to the domain of the Puppet client.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 7.3.0-0
changelog:
  - Fixed a bug in the systemd override file for rsyslog
  - Added fact for version of rsyslogd
  - Updated templates to use RainerScript rsyslogd v8 and later
  - Fixed the MainMsgQueueDiscardMark and MainMsgQueueWorkerThreads
    parameters


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 7.3.0-0
changelog:
  - Added logic to properly handle rsyslogd parameters for V8.6 and later
    as documented in CentOS 7.5 Release notes.  These include moving -x and -w
    options to global.conf and issuing deprecation warning for -l and -s
    options.


author: Nick Miller <nick.miller@onyxpoint.com> - 7.3.0-0
changelog:
  - Changed rsyslog::install::ensure from 'latest' to 'installed'
    - It will also respect `simp_options::package_ensure`


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 7.4.0-0
changelog:
  - Set rsyslog::rule::local::file_create_mode to 0640 by default
  - Allow the following to be set directly via Hiera using simplib::dlookup:
    - rsyslog::rule::local::file_create_mode
    - rsyslog::rule::local::dir_create_mode
    - rsyslog::rule::local::queue_max_file_size


author: Nick Markowski <nmarkowski@keywcorp.com> - 1.0.0-2
changelog:
  - Added a custom type to set the selinux mode.  It autorequires all
    selboolean types.  This replaces the selinux_enable execs in the init manifest.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 1.0.0-3
changelog:
  - Rewrite the native type to properly handle all options.
  - Remove incorrect use of !! in the selinux provider.


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 1.0.3-0
changelog:
  - Ensure that policycoreutils-python is only installed if not installed
    elsewhere. This deconflicts with various hotfixes that were needed in other
    modules.


author: Nick Markowski <nmarkowski@keywcorp.com> - 2.1.0-0
changelog:
  - Fixed a bug wherein setenforce would run if selinux was disabled
  - Changes in selinux state incur a reboot notification


author: Nick Miller <nick.miller@onyxpoint.com> - 2.1.0-0
changelog:
  - Moved management of mcstrans and restorecond to the selinux module
  - Change default packages ensure to use the catalyst
  - Update puppet requirement in metadata.json


author: Liz Nemsick <lnemsick.simp@gmail.com> - 2.1.0-0
changelog:
  - Rework manifests to ensure mcstrans and restorecond services are not
    running when selinux is disabled.
  - Allow this module to manage restorecond package installation.


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> -2.2.0-0
changelog:
  - simp_options::selinux was supposed to indicate if the selinux module should
    be included. Class include lists set in the simp module would include selinux  reguardless
    of this setting.  This option was also being used to set the state of selinux.
    This caused confusion so  simp_options::selinux setting was removed.
    The selinux state, set by the ensure parameter, is defaulted to 'enforcing'.
    This will result in the same behavior as if simp_options::selinux was set to true.
    See the pupmod-simp-simp module to see which scenarios include selinux by default.


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 2.2.0-0
changelog:
  - simp_options::selinux was supposed to indicate if the selinux module should
    be included. Class include lists set in the simp module would include selinux
    regardless of this setting.  This option was also being used to set the state
    of selinux.  This caused confusion so  simp_options::selinux setting was
    removed.  The selinux state, set by the ensure parameter, is defaulted to
    'enforcing'.  This will result in the same behavior as if simp_options::selinux
    was set to true.  See the pupmod-simp-simp module to see which scenarios
    include selinux by default.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 2.3.0-0
changelog:
  - Adds a `selinux_login` custom type that provides for the management of login
    to user role mappings.
  - Incorporated the fork of the `voxpupuli-selinux` module as `simp-vox_selinux`
    without conflict
  - Add support for OEL and Puppet 5
  - Fix bug with enforcement switching in the native type


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 2.4.0-0
changelog:
  - Add `selinux::kernel_enforce` for toggling the enforcement of the selinux
    state at the kernel command line.
  - Switch the /etc/selinux/config template over to EPP format.
  - Deprecate Puppet 4 support
  - Add Puppet 6 support


author: Nicholas Hughes, Nick Markowski <nmarkowski@keywcorp.com> - 2.0.0-0
changelog:
  - Introduced rsyslog rule orders so messages hit 'stop' rules before they
    reach 'catch-alls'.  By doing so, log duplication is prevented.
  - Modified the spooler log local rule to ensure both uucp and news
    facilities are logged in spooler.log.


author: Nick Miller <nick.miller@onyxpoint.com> - 2.0.1-0
changelog:
  - Added simp::kmod_blacklist profile to manage the kernel blacklist using puppet-kmod
    - config migrated from simplib


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 3.0.0-0
changelog:
  - Added a 'simp::ctrl_alt_del' class for managing the behavior of giving a
    system the three finger death punch


author: Nick Miller <nick.miller@onyxpoint.com> - 3.0.0-0
changelog:
  - Removing including of simp::server::* classes from the simp::server
    class in favor of including them in the class list in hiera.
  - Removed any dangling references or dependencies on ganglia or snmpd
  - Rearranged logic in sysctl and removed the ipv6 catalyst. ipv6 will now be
    unmanaged by default.
  - Beefed up simp::server class to include more default classes
  - Made $rsync_stunnel enabled by default


author: Nick Markowski <nmarkowski@keywcorp.com> - 3.0.0-0
changelog:
  - Modified rsync stunnel logic to add a connection to the rsync server
    only if the machine is *not* the rsync server.


author: Nick Miller <nick.miller@onyxpoint.com> - 3.0.1-0
changelog:
  - Moved runpuppet template to its own class so the rupuppet script
    can be managed independently from the simp::server::kickstart class


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 3.1.0-0
changelog:
  - Added the new Grafana GPG key to the list and retained the old one until they
    re-sign their old packages.
  - Add the basic SIMP scenarios to the module
    - simp -> full SIMP profile
    - simp_lite -> SIMP with the more aggressive parts removed
    - poss -> only connect to the puppet server


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 3.1.0-0
changelog:
  - move fips from base scenario to simp scenario
    - made the inclusion of fips module not depend on simp_options::fips setting
    - it is included because it used to turn fips on and off.


author: Dylan Cochran <dylan.cochran@onyxpoint.com> - 4.0.0-0
changelog:
  - Fixed the confusion with the 'classes' global Array
  - Added support for a 'simp::classes' Array with a knockout prefix of '--'
  - Moved scenarios into data in modules


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 4.0.0-0
changelog:
  - Updated the YUM configuration so that no repos are set up by default and it
    is simple to connect to the public repos for SIMP.
  - Yum repos are now individual profiles that can be included ala carte


author: Nick Markowski <nmarkowski@keywcorp.com> - 4.0.0-0
changelog:
  - Updated apache rsync hosts_allow to $trusted_nets. The previous value
    of 127.0.0.1 would not allow apache to rsync if stunnel was disabled.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 4.8.0-0
changelog:
  - Replaced use of the simplib's Puppet 3 array_include function with
    stdlib's member function
  - Use simplib::host_is_me in lieu of simplib's Puppet 3 host_is_me
  - Use simplib::simp_version in lieu of simplib's Puppet 3 simp_version


author: Nick Miller <nick.miller@onyxpoint.com> - 4.8.0-0
changelog:
  - Add exceptions to the filebucket management and the vardir/simp management
    to support running from Bolt


author: Joseph Sharkey <shark.bruhaha@gmail.com> - 4.8.0-0
changelog:
  - Remove Elasticsearch and Grafana GPG Keys
  - Added missing simp::sysctl value simp::sysctl::net__ipv4__conf__default__log_martians
  - Remove Elasticsearch and Grafana GPG Keys
  - Standardized cron datatypes to use the Simplib::Cron::### types.  This
    allows more flexibility in cron scheduling.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 4.8.0-0
changelog:
  - Refactor the simp::mountpoints::tmp to use systemd's tmp.mount target if
    the system supports systemd.
  - Added net.ipv6.conf.all.accept_ra to simp::sysctl management
  - Fixed a bug where the root password field was attempting to set an 'undef'
    value as Sensitive.
  - Bumped the supported Puppet version to include Puppet 6
  - Removed Puppet 4 from the supported list


author: Liz Nemsick <lnemsick.simp@gmail.com> - 4.8.0-0
changelog:
  - Fixed a bug on el6 systems in which the 'puppetdb-dlo-cleanup' cron
    job from the puppetdb module could not be created. Cron rejected this
    job because the puppetdb user did not have cron access.
  - Added 2 'dead letter office' cleanup configuration parameters to
    `simp::puppetdb`
    - simp::puppetdb::automatic_dlo_cleanup which maps directly to
      puppetdb::automatic_dlo_cleanup
    - simp::puppetdb::dlo_max_age which maps directly to puppetdb::dlo_max_age


author: Jeanne Greulich <jeannegreulich@onyxpoint.com> - 4.8.1-0
changelog:
  - Set permission on /etc/simp and /etc/simp/simp.version to world readable.
    Puppet needs to be able to read it for simp_version fact.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 4.9.0-0
changelog:
  - Add SELinux login context management to `simp::admin`
  - Update the version of simp-selinux
  - Update the upper bound on puppetlabs-stdlib


author: Nick Miller <nick.miller@onyxpoint.com> - 4.1.0-0
changelog:
  - simp::yum::internet_simp* repos now use facts in Yum repo baseurls in place
    of yum macros, who's output is not reliable.


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 4.1.1-0
changelog:
  - call simp::nsswitch in simp and simp-lite scenario instead of just nsswitch
    to set nsswitch according to simp_options instead of just the nsswitch defaults.


author: Chris Tessmer <chris.tessmer@onyxpoint.com> - 4.2.0-0
changelog:
  - Fail compilation for a subset of SIMP capabilities, if they are
    used on unsupported operating systems.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 4.3.0-0
changelog:
  - In simp::sysctl, add parameters for net.ipv6.conf.all.accept_source_route
    and net.ipv6.conf.default.accept_source_route and set them to 0 by
    default.  This satisfies STIG CCI-0000366.
  - Small test fixes to allow acceptance tests to run on servers in FIPS mode


author: Liz Nemsick <lnemsick.simp@gmail.com> - 4.4.0-0
changelog:
  - Add simp::prelink to the class lists for both the SIMP server and
    SIMP clients. By default, simp::prelink ensures any prelinking has
    been removed and that the prelink package is not installed. This
    satisfies the SCAP Security Guide's OVAL check
    xccdf_org.ssgproject.content_rule_disable_prelink.


author: Nick Miller <nick.miller@onyxpoint.com> - 4.4.0-0
changelog:
  - When the host is a member of an IPA domain, do not include the
    `simp_openldap::client` class.
  - Update upper bound for concat dependency


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 4.4.0-0
changelog:
  - Remove management of the 'root' user's groups in the User resource
    - Works around https://tickets.puppetlabs.com/browse/PUP-8470


author: Liz Nemsick <lnemsick.simp@gmail.com> - 4.4.0-0
changelog:
  - Set the ownership and permissions of puppet/puppetdb.conf in
    simp::puppetdb, instead of allowing them to be set to those of
    the process running puppet, if the file needs to be created.
    This is part of the fix to the failure of SIMP to bootstrap on a
    system on which root's umask has already been restricted to 077.


author: Nick Miller <nick.miller@onyxpoint.com> - 4.4.0-0
changelog:
  - Fixed a bug where if the `puppet_settings` fact did not exist, users in the
    `%administrators` group could `rm -rf` any path
  - The value in the hash was also corrected to
    `$facts['puppet_settings']['main']['ssldir']`


author: Liz Nemsick <lnemsick.simp@gmail.com> - 4.4.0-0
changelog:
  - In simp::prelink, ensure prelinking is disabled when the server is
    in FIPS mode, as FIPS is incompatible with prelinking.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 4.4.1-0
changelog:
  - Ensure that a file exists on EL 6 if portreserve is enabled so that the
    portreserve service does not flap


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 4.5.0-0
changelog:
  - changed permission on ctrl-alt-del-capture.service to prevent "no effect"
    errors in system logs.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 4.5.0-0
changelog:
  - In the runpuppet init script used to bootstrap kickstarted clients,
    for EL7, persist the hostname retrieved by DHCP as a static hostname.
    This prevents problems that can arise on EL7 when the DHCP lease
    expires in the middle of the client bootstrap puppet runs.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 4.5.0-0
changelog:
  - Narrow the focus of the internal hieradata to ensure correct runs on
    unsupported OSs
  - Update unsupported OS tests
  - Add a test to ensure that an error is throw if an invalid scenario is
    specified


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> 4.5.0-0
changelog:
  - simp_options::selinux was supposed to determine if the selinux module was
    included.  However, this value was getting overridden by the class lists
    which independently included the selinux module. This change removes the
    unused simp_options::selinux setting to eliminate the confusion.  See the
    scenario maps in the data section to see what scenarios include the selinux
    module.  See the selinux module to see how to use puppet to enable/disable
    selinux.  This may change the defaults for selinux in the `simp_lite`
    scenario.


author: Nick Miller <nick.miller@onyxpoint.com> - 4.5.0-0
changelog:
  - Add simp::netconsole class to manage the netconsole kernel feature
  - Fix a few puppet-lint warnings


author: Liz Nemsick <lnemsick.simp@gmail.com> - 4.5.0-0
changelog:
  - Created standalone SIMP client bootstrap script, bootstrap_simp_client.
  - Created simp::server::kickstart::runpuppet replacement,
    simp::server::kickstart::simp_client_bootstrap, that manages service
    files for kickstarting a SIMP client, using bootstrap_simp_client
    and either a sysv (simp_client_bootstrap) or a systemd
    (simp_client_bootstrap.service) service script. This replacement
    provides the following improvements:
    - Exponential backoff of requests to the Puppet server, to minimize
      Puppet server overload.
    - Configurable bootstrap timeout.
    - An option to force a client reboot on client bootstrap failure.
    - More effective puppet agent processing.  The bootstrapping
      takes fewer puppet agent runs.
    - Finer grained control of the bootstrap algorithm.
    - Error handling
      - Bootstrap operation errors are now detected and logged.
      - Failed puppet agent runs are now retried, instead of blindly
        continuing on.
    - Timestamped log messages in the bootstrap log file.  This includes
      messages from bootstrap_simp_client, puppet agent, and fixfiles.
      service start
  - simp::server::kickstart::runpuppet is deprecated and will be removed
    in a future release


author: Dylan Cochran <dylan.cochran@onyxpoint.com> - 4.5.0-0
changelog:
  - Add Windows support
  - Change /root perms to RPM default of 0550
  - Change /etc/rc.d/rc.local perms to RPM default of 0755


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 4.5.0-0
changelog:
  - Use the sudo::user_specification default host list which is correct for
    almost all cases
  - Update version range of auditd dependency in metadata.json


author: Nick Miller <nick.miller@onyxpoint.com> - 4.6.0-0
changelog:
  - Added tests and support for OEL and Puppet 5
    - Setting the default filebucket in a module no longer works, so
      ``simp::enable_filebucketing`` will do nothing in puppet version >= 5
  - Fixed some linting issues


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 4.6.0-0
changelog:
  - Switch from using 'sudosh' as the default logging shell to using 'tlog'
  - Add a 'simp::admin::default_admin_sudo_cmnds' option to allow users to easily
    change the default sudo-accessible commands from Hiera.
  - Ensure that the global filebucket setting occurs prior to class inclusion to
    match the new Puppet 5 method of setting resource defaults.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 4.6.0-0
changelog:
  - Fix a usability bug in which simp::server::kickstart did not allow
    the bootstrap scripts provided by simp::server::kickstart::runpuppet
    and simp::server::kickstart::simp_client_bootstrap to be configured
    via hieradata, when those classes were managed by simp::server::kickstart.


author: Nick Miller <nick.miller@onyxpoint.com> - 4.6.0-0
changelog:
  - Added $simp::server::yum::createrepo_ensure parameter
    - Changed the package from 'latest' to 'installed'
    - It will also respect `simp_options::package_ensure`


author: Nicholas Hughes, Nick Markowski <nmarkowski@keywcorp.com> - 5.0.1-0
changelog:
  - Prevent log duplication and log where intended
  - Changed naming to XX_ or YY_ to come before the default Z_default.conf
    for local rules, but after the numbered configs used by the log_server
    class.


author: Nick Miller <nick.miller@onyxpoint.com> - 6.0.0-0
changelog:
  - Renamed `add_site` to `site`
  - Strongly typed module
  - Updated module assets
  - Wrote a basic class acceptance test


author: Nick Miller <nick.miller@onyxpoint.com> - 6.0.0-0
changelog:
  - Fixed dependency logic with mod_ldap to not install it on CentOS 7
  - Rsyslog calls no longer include implied logic
  - Rsync now calls the correct share


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.0.1-0
changelog:
  - Create namespaced, Puppet 4 versions of externally-used Puppet 3
    functions and mark the Puppet 3 functions as deprecated. They will
    be removed in a later release.
    - apache_auth should be replaced with simp_apache::auth
    - apache_limits should be replaced with simp_apache::limits
    - munge_httpd_networks should be replaced with simp_apache::munge_httpd_networks
  - Update puppet requirement and remove OBE pe requirement in metadata.json


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.0.1-0
changelog:
  - Create namespaced, Puppet 4 versions of externally-used Puppet 3
    functions and mark the Puppet 3 functions as deprecated. They will
    be removed in a later release.
  - apache_auth should be replaced with simp_apache::auth
  - apache_limits should be replaced with simp_apache::limits
  - munge_httpd_networks should be replaced with simp_apache::munge_httpd_networks
  - Update puppet requirement and remove OBE pe requirement in metadata.json


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 6.0.2-0
changelog:
  - set owned to simp_apache::user instead of simp_apache group on
    configuration files.
  - remove simpcat as dependency
  - cleaned up fixtures file


author: Nick Miller <nick.miller@onyxpoint.com> - 6.0.2-0
changelog:
  - Update systemd fixtures and CI assets
  - Update version range of auditd dependency in metadata.json


author: Nicholas Markowski <nicholas.markowski@onyxpoint.com> - 6.1.0-0
changelog:
  - Updated $app_pki_external_source to accept any string.  This matches the functionality
    of pki::copy.


author: Nick Miller <nick.miller@onyxpoint.com> - 6.1.0-0
changelog:
  - Added $package_ensure parameters to simp_apache::install
    - $httpd_ensure  $mod_ldap_ensure  $mod_ssl_ensure
    - Changed the package from 'latest' to 'installed'
    - Each ensure parameter will also respect `simp_options::package_ensure`
  - Update badges and contribution guide URL in README.md


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.1.1-0
changelog:
  - Use simplib::passgen() in lieu of passgen(), a deprecated simplib
    Puppet 3 function.
  - Use simplib::nets2cidr in simp_apache::munge_httpd_networks in
    in lieu of nets2cidr(), a deprecated simplib Puppet 3 function.
  - Use simplib::ipaddresses in lieu of ipaddresses(), a deprecated
    simplib Puppet 3 function.
  - Update the upper bound of stdlib to < 6.0.0
  - Update a URL in the README.md


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.2.0-0
changelog:
  - Split out service management into a `simp_apache::service` class
  - Provide users with a Hiera-driveable option to not manage the service
  - Add REFERENCE.md


author: Michael Morrone <michael.morrone@onyxpoint.com> - 0.1.0
changelog:
  - Initial commit.
  - Install and configure Puppet Bolt.
  - Added Hiera configuration.
  - Added acceptance test for deploying a puppet module.


author: Nick Miller <nick.miller@onyxpoint.com> - 0.1.0
changelog:
  - Wrap puppetlabs/docker to:
    - Provide SIMP defaults
    - Add ease-of-use for using different distributions of Docker
  - Document how to set up simp/iptables to ignore docker-generated rules


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.1.0
changelog:
  - Ensure that the docker_group and socket_group options are the same by default
    for the 'redhat' release type


author: Nick Miller <nick.miller@onyxpoint.com> - 0.1.0
changelog:
  - Update to puppetlabs/docker 1.0.5
    - Remove deprecated `manage_epel` parameter
  - Removed $iptables_docker_chain by default
    - The simp/iptables module has been updated so that this is not needed


author: Nick Miller <nick.miller@onyxpoint.com> - 0.1.1
changelog:
  - Update to puppetlabs/docker 1.1.0
    - $selinux_enabled changed from taking string to only taking booleans, 
      breaking the hiera interpolation trick that was used to set that parameter
      to the selinux status of the system.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.2.0-0
changelog:
  - Added a workaround to a long standing bug in puppetlabs/beaker that adds a
    'docker' user with the same gid as 'dockerroot' if it doesn't exist.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 0.2.1-0
changelog:
  - Update the upper bound of stdlib to < 6.0.0
  - Update a URL in the README.md
  - Update to puppetlabs-docker 3.4.0


author: Liz Nemsick <lnemsick.simp@gmail.com> - 5.0.0-0
changelog:
  - Update custom Puppet 3 functions to namespaced, Puppet 4 functions
  - Update puppet requirement and remove OBE pe requirement in metadata.json


author: SIMP Team <simp-project.com> - 0.1.0
changelog:
  - This is the initial code for a `simp_gitlab` module, which installs
    GitLab Omnibus and incorporates it into SIMP.


author: Chris Tessmer <chris.tessmer@onyxpoint.com> - 0.3.0
changelog:
  - Configure LDAP TLS to use the Omnibus' `trusted-certs/` instead of the LDAP
    `ca_file` setting
    (see https://gitlab.com/gitlab-org/gitlab-ce/issues/37254#note_3894021)
  - Add `ldap_verify_certificates` parameter
  - Add `ldap_ssl_protocols` parameter
  - Fixed LDAP provider name sanitation
  - Update deprecated LDAP encryption configurations for GitLab 9.4+
  - Add acceptance tests for LDAP authentication
  - Document acceptance test features
  - Removed unused `syslog` parameter


author: Liz Nemsick <lnemsick.simp@gmail.com> - 0.3.0
changelog:
  - Drop support for CentOS 6 in order to cleanly solve an intermittent
    problem in which the GitLab local user's authorized keys lock file
    could not be created.
  - Modify sshd authorized keys file configuration so that the GitLab
    installer can manage the GitLab local user's authorized keys file
    and the directory in which it resides, independent of Puppet.
    Prior to this, both the GitLab installer (via Chef) and Puppet
    were simultaneously, but independently, managing the ownership,
    permissions, and selinux contexts of that authorized keys file
    and its directory.  Since the desired settings for the directory
    were different, intermittent problems such as the GitLab user
    not being able to create its authorized keys lock file arose.


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 0.3.1
changelog:
  - Updated README to note that authorized key files need to be copied
    when upgrading from version 0.2.0.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 0.4.0-0
changelog:
  - Added missing simp-pki dependency to metadata.json
  - Use ``generate_pem_hash_links`` option of pki_cert_sync to allow
    the gitlab application to manage the certificate hash links.
    ``gitlab reconfigure`` generates those hash links.
  - Added manage_package and package_ensure parameters to simp_gitlab
  - Switched from vshn/gitlab 1.13.3 to its replacement puppet/gitlab
    3.0.2 and reworked the manifests, as appropriate, to work with the
    newer module.
  - Updated the upper bound of stdlib to < 6.0.0
  - Updated a URL in the README.md


author: Ralph Wright <rwright@onyxpoint.com> - 0.1.1-0
changelog:
  - A few minor fixes for seemless install
  - Added option to install SIMP dashboards
  - Added option to allow SIMP dashboards to be installed


author: Liz Nemsick <liz.nemsick-simp@gmail.com> - 1.0.4-0
changelog:
  - Update to latest Grafana (4.2.0) and Elasticsearch (5.4.0)
  - simp_grafana::version now defaults to 'latest'
  - Confine puppet version in metadata.json


author: Liz Nemsick <liz.nemsick-simp@gmail.com> - 1.0.4-0
changelog:
  - Workaround 2-pass grafana rpm install issue in acceptance tests
  - Update README to reflect SIMP 6 global catalysts.


author: Liz Nemsick <liz.nemsick-simp@gmail.com> - 1.0.5-0
changelog:
  - Update upper range of puppet/grafana module dependency to < 5.0.0
  - Update README to include section on rubygem-puppetserver-toml


author: Liz Nemsick <lnemsick.simp@gmail.com> - 1.0.6-0
changelog:
  - Fix bug in resource ordering of pki::copy and grafana::service
  - Use simplib::passgen() in lieu of deprecated passgen()
  - Update badges and contribution guide URL in README.md


author: Nick Miller <nick.miller@onyxpoint.com> - 0.0.2
changelog:
  - Added Puppet Tasks for joining and leaving a domain
  - Fix bug where ntp-server wasn't passed in client install


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 2.0.0-0
changelog:
  - First cut after being split off from the original simp-logstash module.
  - Provides a much cleaner abstraction between this and the upstream Logstash
    material from Elastic.


author: Jeanne Greulich <jgreulich@onyxpoint.com> - 3.0.0-0
changelog:
  - Update major version release for SIMP 6
  - Removed stunnel and replaced it with TCP TLS input
  - Added TLS enabled JSON input
  - Updated tests


author: Liz Nemsick <lnemsick.simp@gmail.com> - 5.0.0-0
changelog:
  - Updated to LogStash 5.X and Elasticsearch 5.X
  - Fixed type bug in simp_logstash::output::elasticsearch::action.
  - Fixed enum typo in enum for simp_logstash::output::elasticsearch::script_type
  - Fixed puppet strings problems.
  - Confine puppet version in metadata.json


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.0.2
changelog:
  - Added the ability to override ciphers in the create_home_directories script
    for EL6 since the cipher order does not happen from strongest to weakest and
    breaks secure LDAP connections
  - Added a check for create_home_directories to ensure that directories are not
    archived if the server doesn't respond for TLS reasons.


author: Nick Markowski <nmarkowski@keywcorp.com> - 0.0.3
changelog:
  - Updated create_home_directories to handle multiple URIs
  - Update puppet requirement in metadata.json


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.0.5
changelog:
  - Allow users to properly disable autofs
  - Added parameter, autodetect_remote, that allows users to disable the logic
    that determines if system is an NFS server and mounts directories locally.
    This allows the mounting of home directories to another NFS server.


author: Nick Miller <nick.miller@onyxpoint.com> - 0.1.0
changelog:
  - Add support for Puppet 5 and OEL
  - Upped stdlib dep to support version 5
  - Add reference.md
  - Added $simp_nfs::create_home_dirs::package_ensure parameter
    - Changed the package from 'latest' to 'installed'
    - It will also respect `simp_options::package_ensure`


author: Joseph Sharkey <shark.bruhaha@gmail.com> - 0.1.1
changelog:
  - Remove Elasticsearch and Grafana GPG Keys
  - Updated tests in support of puppet6, and removed puppet4 support


author: Liz Nemsick <lnemsick.simp@gmail.com> - 4.1.9-0
changelog:
  - Fixed bug in which multiple URIs in ldap hieradata were not written
    into ldap.conf.
  - Corrected variable reference in ldap.conf.erb


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.0.0-0
changelog:
  - Rename from 'openldap' to 'simp_openldap' so that we can migrate to an
    alternate backend in the future


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.0.1-0
changelog:
  - Removed the 'acl' log level from the default list since it was causing low
    server response time on some EL7 systems
  - Corrected the openldap::server::conf::conn_max_pending_auth to be set to 1000
    instead of 100


author: Nick Markowski <nmarkowski@keywcorp.com> - 6.0.3-0
changelog:
  - Updated logrotate to use new lastaction API
  - Updated all ldap DNs to uppercase DC=
  - Update puppet requirement in metadata.json


author: Nick Markowski <nmarkowski@keywcorp.com> - 6.1.0-0
changelog:
  - Per CVE-2014-3566, SSLv3 and TLSv1 ciphers should be disallowed. Recent-ish
    updates to openldap-servers, shipped with SIMP-6.0.0-0, includes a parameter
    to specify a minimum bound of TLS protocol in slapd.conf, TLSProtocolMin.
    (see https://access.redhat.com/solutions/1234843)
  - This commit includes puppetry to remove TLSv1.0, SSLv3, and SSLv2 from the
    TLS cipher suites, and set a minimum TLS protocol of TLSv1.2, given
    openldap-servers is >= 2.4.40.
  - Updated syncdn and binddn defaults in server::conf


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.1.1-0
changelog:
  - Fixed an issue where pki::copy was not correctly hooked into the server logic
    and a system PKI update would not properly propagate into the OpenLDAP
    service restart.


author: Nick Miller <nick.miller@onyxpoint.com> - 6.2.1-0
changelog:
  - Update to support Puppet 5 and OEL
  - Update systemd fixtures and CI assets
  - Fix acceptance test by not testing text of failure code, only the exit code
  - Remove unneeded simp/auditd dependency


author: Mark Fitch <CodePhase@users.noreply.github.com> - 6.2.1-0
changelog:
  - Ensure that the `concat` statement for `access.conf` is sorted in `numeric`
    order for consistency.


author: Nick Miller <nick.miller@onyxpoint.com> - 6.3.0-0
changelog:
  - Added the following package ensure parameters
    - $simp_openldap::client::openldap_clients_ensure
    - $simp_openldap::client::nss_pam_ldapd_ensure
    - $simp_openldap::slapo::lastbind::lastbind_ensure
    - $simp_openldap::slapo::ppolicy::ppolicy_ensure
  - Changed the defaults for all package ensures from 'latest' to the following:
    - `simp_options::package_ensure` when that parameter is present
    - 'installed' otherwise
  - Require Puppet versions greater than 4.10.4, and don't test on it
  - Update badges and contribution guide URL in README.md


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.3.2-0
changelog:
  - Use simplib::validate_re_array in lieu of deprecated Puppet 3 validate_re_array
  - Use Puppet Integer() in lieu of simplib's deprecated Puppet 3 to_integer


author: Nick Miller <nick.miller@onyxpoint.com> - 1.0.1-0
changelog:
  - Added more strict Puppet and PE requirements, pinning to Puppet 4.7+ and
    PE 2016.4.0+
  - Updated openssl::cipher_suite to be set to the fips_ciphers fact if it's
    available to expand the 'FIPS' shortcut, which causes issues with some
    applications (openldap)


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 1.1.0-0
changelog:
  - Added simp_options::uid and simp_options::gid classes for ID limit
    consistency across the entire infrastructure


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 1.2.0-0
changelog:
  - Removed simp_options::selinux.  Conflicts between this setting
    and what was in the scenario class lists was causing unexpected results.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 1.2.3-0
changelog:
  - Use simplib::validate_net_list in lieu of deprecated Puppet 3
    validate_net_list
  - Use simplib::validate_uri_list in lieu of deprecated Puppet 3
    validate_uri_list


author: Steven Pritchard <steven.pritchard@onypoint.com> - 1.3.0-0
changelog:
  - Add v2 compliance_markup data
  - Drop Puppet 4 support
  - Add Puppet 6 support
  - Add support for puppetlabs-stdlib 6


author: SIMP Team <simp-project.com> - 0.0.1
changelog:
  - This is the initial code for a `simp_pki_service` module, which is a
    SIMP-oriented installation of the Dogtag Certificate System.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.2.0
changelog:
  - Minor breaking changes - Module still **experimental**
  - Fix the configuration variants required for the documented layout
    - Add acceptance tests for swapping out puppet certificates
      - This is the "real life" test case outside of just setting up the CA
        infrastructure


author: Liz Nemsick <lnemsick.simp@gmail.com> - 0.2.0
changelog:
  - Update documentation
  - Add acceptance tests for obtaining certs via CMC and certmonger
  - Update the upper bound of stdlib to < 6.0.0


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> 0.0.2
changelog:
  - Fixed directory for log rotate of central log server
  - add warning if possible log looping detected


author: Liz Nemsick <lnemsick.simp@gmail.com> - 0.1.0-0
changelog:
  - Fix bug whereby audit logs were not being forwarded to remote syslog servers. 
  - Fix bugs whereby simp_rsyslog::log_collection and simp_rsyslog::log_openldap
    parameters were overriding simp_rsyslog::default_logs instead of being merged.
  - Work around rsyslog inconsistent message parsing behavior that prevented
    iptables logs from being written to iptables.log and/or being forwarded,
    for some versions of rsyslog.
  - Ensure local audispd log messages are not duplicated.
  - Adjust local rule ordering to ensure local sudosh and apache (httpd)
    log messages are written to their own log files.
  - Restore writing of local puppet and puppet-server messages to their
    own files, by adjusting local security rsyslog rule from simp_rsyslog::local.
  - Update puppet requirement in metadata.json


author: Liz Nemsick <lnemsick.simp@gmail.com> - 0.1.0-0
changelog:
  - Fix bug whereby audit logs were not being forwarded to remote syslog servers.
  - Fix bugs whereby simp_rsyslog::log_collection and simp_rsyslog::log_openldap
    parameters were overriding simp_rsyslog::default_logs instead of being merged.
  - Work around rsyslog inconsistent message parsing behavior that prevented
    iptables logs from being written to iptables.log and/or being forwarded,
    for some versions of rsyslog.
  - Ensure local audispd log messages are not duplicated.
  - Adjust local rule ordering to ensure local sudosh and apache (httpd)
    log messages are written to their own log files.
  - Restore writing of local puppet and puppet-server messages to their
    own files, by adjusting local security rsyslog rule from simp_rsyslog::local.
  - Update puppet requirement in metadata.json


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.3.0-0
changelog:
  - Remove redundant rules for sudosh since the puppet module will correctly take
    care of adding those rules
  - Add support for tlog since it will be commonly replacing sudosh across the
    SIMP infrastructure


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 0.3.0-0
changelog:
  - Update simp_rsyslog::forward to allow configuration of the
    StreamDriverPermittedPeers directive in the forwarding rule actions
    for the remote rsyslog servers.  This allows the user to set the correct
    StreamDriverPermittedPeers value, when the default value is incorrect
    (e.g., when IP addresses are used in simp_rsyslog::log_servers or
    simp_rsyslog::failover_servers and one or more of those servers
    is not in the same domain as the client).


author: Nick Miller <nick.miller@onyxpoint.com> - 0.3.0-0
changelog:
  - Removed hardcoded strings
    - Make directory where logs are gathered configurable
    - Also make rules that organizes them configurable
  - Update systemd fixtures and CI assets
  - Add support for Puppet 5 and OEL
  - Use iptables module in acceptance tests instead of hand generated rules


author: Liz Nemsick <lnemsick.simp@gmail.com> - 0.1.2-0
changelog:
  - Use simplib::passgen() in lieu of passgen(), a deprecated simplib
    Puppet 3 function.
  - Expanded the upper limit of the stdlib Puppet module version
  - Updated a URL in the README.md
  - Update miniminum version of snmp module to 4.1.0.  This project
    is now maintained by Vox Pupuli and has changed from razorsedge-snmp
    to puppet-snmp.


author: Kendall Moore <kmoore@keywcorp.com> - 2.1.1-3
changelog:
  - Updated provided for concat_build so that empty concat fragments wouldn't error out when
    quiet is set to true.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 4.0.0-2
changelog:
  - Updated the concat_output and fragmentdir functions to properly
    handle String/Array conversions in Ruby 2.


author: Nick Miller <nick.miller@onyxpoint.com> - 6.0.0-0
changelog:
  - Changed from using Puppet[:vardir] to Facter.value(:puppet_vardir), which
    accounts for the different vardirs on agent and server.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 3.9.0-0
changelog:
  - Add an 'ipa' fact that provides the IPA domain and server to which
    a host is connected, when the host is joined to the IPA domain.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 3.9.0-0
changelog:
  - Updated the simplib::ldap::domain_to_dn function to allow users to choose
    whether they want to upcase or downcase the LDAP attributes to work around
    different system bugs
  - Updated min_uid fact for OEL and Scientific Linux
  - Updated tests


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 3.9.1-0
changelog:
  - Made the `init_ulimit` custom type safe for `puppet generate types`
  - Fixed a typo in the composite namevar for `init_ulimit`
  - The following changes allow users to disable reboot notify messages
    - Adds two parameters :log_level and :control_only to the 'reboot_notify'
      custom type.
      * :log_level    => Set the Puppet log level of the generated message
      * :control_only => Indicate that this entry should not be added to
                         the generated file
    - Added a `Simplib::PuppetLogLevel` Data Type
    - Added a 'reboot_control_metadata' section to the on-system record file
    - Added a `simplib::reboot_notify` class to allow for ease of global
    metadata manipulation.
  - Fixed file paths that were not Windows compatible
  - Improved error handling in `reboot_notify` and fixed a few small bugs
  - Improved some tests


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 3.10.0-0
changelog:
  - Add a 'simplib::install' defined type that allows users to provide a Hash of
    packages to install along with a Hash of defaults to apply to those packages
    and override each package configuration if necessary.
    - This was originally created by Nick Miller <nick.miller@onyxpoint.com>


author: dforste <dforste@users.noreply.github.com> - 3.10.0-0
changelog:
  - Fixed bug in cmdline face where duplicate parameters would be ignored
    - Duplicate parameters now turn the value of the parameter into an array


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 3.10.0-0
changelog:
  - Added a function `module_exist` that will return whether or not a module
    exists in the current environment.
  - Fixed an issue in the 'runlevel' provider where the actual runlevel would not
    be changed at execution time


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 3.10.1-0
changelog:
  - Added timeout for changing runlevels based on issues discovered in the field
  - Fixed bugs in the EL6 runlevel persistence where, in some cases, the runlevel
    line might not get written to /etc/inittab


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 3.11.0-0
changelog:
  - Added a function `assert_optional_dependency` that allows users to fail if
    expected functionality is not present in the current environment's module
    set. This provides the ability for users to support multiple vendor modules
    without forking.


author: Chris Tessmer <chris.tessmer@onyxpoint.com> - 3.11.0-0
changelog:
  - Fixed a bug in the `puppet_settings` fact where settings from all sections
    were interpolated using settings (like `$vardir`) from the `[main]` section.


author: Daniel Henninger <daniel@vorpalcloud.org> - 3.11.1-0
changelog:
  - Fixed bug where uid_min would throw errors under operating systems
    without /etc/login.defs.
  - Fixed bug where simplib_sysctl would throw an undefined method error
    on non-Linux OS's.  (both those with sysctl (MacOS X) and without (Windows))
  - Both patches of which were improved by Trevor Vaughan <tvaughan@onyxpoint.com>.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 3.11.1-0
changelog:
  - Fix reboot_notify tests
  - Ensure that reboot_notify updates resources based on a modified 'reason'
  - Fix the ipaddresses tests
  - Add better confinement on boot_dir_uuid
  - Add a docker nodeset
  - Add test for catching facter errors
  - Bumped the minimum version of Puppet to 4.10.4


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 3.12.0-0
changelog:
  - Add support for fs.inotify.max_user_watches to
    simplib::validate_sysctl_value()
  - Fix bug in simplib::assert_metadata where it could not be disabled
    - Thanks to Adam Hagen for filing the proposed patch in JIRA
  - Add a 'defined type' lookup capability, `simplib::dlookup` that provides a
    consistent method for retrieving defined type parameters from Hiera in an
    opt-in manner.
  - Fixed various YARD documentation issues


author: Chris Tessmer <chris.tessmer@onyxpoint.com> - 3.15.0-0
changelog:
  - Removed simplib's `deep_merge()` 3.x function that conflicts with stdlib's
    fully-equivalent `deep_merge()` function.
    - Has no impact on uses of `deep_merge` (hence a bug fix not a major version
      change).
    - Eliminates 'Illegal method definition' errors caused by the conflict,
      when using Puppet 6.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 3.15.0-0
changelog:
  - Deprecated simplib Puppet 3 functions for which corresponding,
    though not identically behaving, Puppet builtins or stdlib
    functions exist.  The functions will be removed in a future
    release, unless SIMP receives requests from users to convert
    them to namespaced Puppet 4.x functions.
    - array_include() can often be replaced with stdlib member()
    - array_size() can often be replaced with the Puppet builtin length()
    - slice_array() can often be replace with the Puppet builtin slice()
  - Deprecated Puppet 3 functions that are not used by any SIMP
    modules.  The functions will be removed in a future release,
    unless SIMP receives requests from users to convert them to
    namespaced Puppet 4.x functions.
    - array_union
    - generate_reboot_msg
    - get_ports
    - h2n
    - ip_is_me
    - localuser
    - mapval
    - validate_array_of_hashes
    - validate_float
  - Convert a subset of Puppet 3 functions to Puppet 4 and emit a
    simplib deprecation warning when the Puppet 3 versions are called:
    - simplib::simp_version() replaces deprecated simp_version().
    - simplib::host_is_me() replaces deprecated host_is_me().
  - Remove Puppet 3 validate_integer function that conflicts with the
    same-named Puppet 3 function provided by puppetlab-stdlib.
    - Has no impact on uses of `validate_integer` (hence a bug fix not a major
      version change).
    - Eliminates 'Illegal method definition' errors caused by the conflict,
      when using Puppet 6.


author: Joseph Sharkey <shark.bruhaha@gmail.com> - 3.15.0-0
changelog:
  - Fixed a bug in simplib::nets2ddq where it would incorrectly try to
    expand an IPv6 CIDR.  It now passes IPv6 addresses through untouched.
  - Converted bracketize Puppet 3 function to simplib::bracketize Puppet 4
    function and emit a simplib deprecation warning when bracketize is
    called.
  - Added capability for simplib::bracketize to accept a string
    delimited by: comma, space, and/or semi-colon


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 3.15.0-0
changelog:
  - Added a 'simplib_networkmanager' fact to provide useful information about the
    state of NetworkManager components.


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 3.15.1-0
changelog:
  - Updated simp_version function to use Puppet::Util::Execution.execute
    instead of backtics.  This avoids a GLIBC error triggered by JRuby 9K when
    backtics, system or %x are used.


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 3.15.3-0
changelog:
  - Allow users to disable deprecation warnings using SIMPLIB_NOLOG_DEPRECATIONS
    environment variable


author: Nick Miller <nick.miller@onyxpoint.com> - 2.0.0-0
changelog:
  - Renamed the file containing the puppet_settings fact to deconflict with
    puppetlabs/puppetlabs-stdlib. They don't create any facts with the name
    `puppet_settings`, so this works for now.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 2.1.0-0
changelog:
  - Added a set of Data Types
    - EmailAddress
    - Host (Single IP or Hostname)
    - Hostname
    - Hostname
    - IP
    - IP::V4
    - IP::V4::CIDR
    - IP::V4::DDQ
    - IP::V4::Port (with port)
    - IP::V6
    - IP::V6::Base (Regular IPv6)
    - IP::V6::Bracketed (IPv6 with Brackets)
    - IP::V6::CIDR
    - IP::V6::Port (with port)
    - Netlist
    - Netlist::IP
    - Netlist::IP::V4
    - Netlist::IP::V6
    - Port (any of the below)
    - Port::Dynamic (49152-65535)
    - Port::Random (0)
    - Port::System (1-1024)
    - Port::User (1025-49151)
    - URI
  - Added a simplib::lookup() function that returns a globally scoped variable if
    it exists before calling the traditional lookup() function.


author: Nick Miller <nick.miller@onyxpoint.com> - 3.0.0-0
changelog:
  - NOTE: THIS MODULE CONTAINS NO MORE CLASSES OR MANIFESTS
  - Migrated content in manifests and templates to other modules.
    - See SIMP-1679 for details


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 3.1.0-0
changelog:
  - Added types to cover entries with Ports
    - Host::Port
    - Hostname::Port
    - Netlist::Port
    - IP::Port
  - Added IP::CIDR type


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 3.1.0-0
changelog:
  - Added additional syslog data types and added tests for all syslog data types
    - Syslog::CFacility
    - Syslog::CPriority
    - Syslog::CSeverity


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 3.2.0-0
changelog:
  - Added a simplib::ldap::domain_to_dn function for generating a reasonable Base
    DN from the domain fact


author: Liz Nemsick <lnemsick.simp@gmail.com> - 3.4.0-0
changelog:
  - Use the standard ip utility to determine default gateway information,
    instead of the netstat utility. This removes a dependency on the
    net-tools package.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 3.4.0-0
changelog:
  - Added a pre and post stage that wrap around the stdlib stages to ensure that
    all SIMP components have proper buffers around the rest of the stdlib stages
    that other users might be using.
  - Added a `simplib_sysctl` fact to provide values that are particularly
    relevant to SIMP installations.
  - Fixed a bug in the `puppet_settings` fact in the case where `facter` was run
    standalone
  - Added a 'root_dir_uuid' fact so that it can be compared against the `/boot`
    partition in the fips module. Facter used to have a data structure of all
    mountpoints but it was removed for performance reasons.


author: Nick Markowski <nmarkowski@keywcorp.com> - 3.4.0-0
changelog:
  - Due to lack of support for knockout_prefix for arrays in older versions
    of Puppet, simp::knockout functionality has been moved to
    simplib::knockout because multiple modules are using the function.
  - A wrapper has been put around simp::knockout for backwards-compatibility
    in our code.
  - Update puppet requirement in metadata.json


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 3.5.0-0
changelog:
  - Added a 'simplib::assert_metadata_os' function that will fail the compile if
    the passed module does not support the operating systems defined in the
    module's metadata.json.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 3.5.0-0
changelog:
  - Add simplib-specific deprecation functions for both Puppet 3 functions
    (simplib_deprecation()) and Puppet 4 functions (simplib::deprecation()).
  - Convert a subset of Puppet 3 functions to Puppet 4 and emit a
    simplib deprecation warning when the Puppet 3 versions are called:
    - simplib::inspect() replaces deprecated inspect()
    - simplib::ipaddresses() replaces deprecated ipaddresses()
    - simplib::parse_hosts() replaces deprecated parse_hosts()
    - simplib::passgen() replaces deprecated passgen()
    - simplib::strip_ports() replaces deprecated strip_ports()
    - simplib::to_integer() replaces deprecated to_integer()
    - simplib::to_string() replaces deprecated to_string()
    - simplib::validate_uri_list() replaces deprecated validate_uri_list()
    - simplib::validate_net_list() replaces deprecated validate_net_list()
    - simplib::validate_port() replaces deprecated validate_port()
  - Add single-line json output option to simplib::inspect()


author: Liz Nemsick <lnemsick.simp@gmail.com> - 3.5.0-0
changelog:
  - Convert a subset of Puppet 3 functions to Puppet 4 and emit a
    simplib deprecation warning when the Puppet 3 versions are called:
    - simplib::ip_to_cron() replaces deprecated ip_to_cron()
    - simplib::rand_cron() replaces deprecated rand_cron()
  - Add algorithm options to simplib::ip_to_cron() and
    simplib::rand_cron() to allow the user to select the transformation
    algorithm, instead of defaulting to an IP number modulus, when the
    entity to be transformed is an IP address.  The IP number modulus
    algorithm produces undesirable clustering when used to randomize IP
    addresses in a system for which the number of IPs to be transformed
    is less than the range over which the randomization is requested.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 3.6.0-0
changelog:
  - Convert all 'sysctl' 'kernel.shm*' entries to Strings
    - shmall and shmmax were causing Facter and newer versions of Puppet to crash
    - See FACT-1732 for additional information
  - Add Puppet function `simplib::assert_metadata_os()`
  - Add data type `Simplib::Puppet::Metadata::OS_support`


author: Liz Nemsick <lnemsick.simp@gmail.com> - 3.7.0-0
changelog:
  - Add Simplib::Macaddress data type
  - Convert a subset of Puppet 3 functions to Puppet 4 and emit a
    simplib deprecation warning when the Puppet 3 versions are called:
    - simplib::join_mount_opts() replaces deprected join_mount_opts()
    - simplib::nets2cidr() replaces deprecated nets2cidr()
    - simplib::validate_re_array() replaces deprecated validate_re_array()
    - simplib::validate_sysctl_value() replaces deprecated validate_sysctl_value()
  - Deprecate validate_umask(), advising the user to convert to the
    Simplib::Umask data type
  - Deprecate validate_macaddresses(), advising the user to convert
    to the Simplib::Macaddress data type
  - Fix bug in which simplib_deprecation() used the wrong environment variable.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 3.8.0-0
changelog:
  - Convert a subset of Puppet 3 functions to Puppet 4 and emit a
    simplib deprecation warning when the Puppet 3 versions are called:
    - simplib::nets2ddq() replaces deprecated nets2ddq().
    - simplib::validate_array_member() replaces
      deprecated validate_array_member()
    - simplib::validate_between() replaces deprecated validate_between().
      The new version fails validation, instead of returning false.
      This behavior consistent with both how the method is used by SIMP
      modules and the error behavior of all other simplib validate
      functions.
    - simplib::validate_bool() replaces deprecated validate_bool_simp()
    -  simplib::validate_deep_hash replaced validate_deep_hash.
  - In simplib::validate_deep_hash, fixed validate_deep_hash bug in
    which unknown keys in the Hash to check were not detected.


author: Chris Tessmer <chris.tessmer@onyxpoint.com> - 3.9.0-0
changelog:
  - Add data types Simplib::Domain and Simplib::Domainlist
  - Re-enabled unit-style data type spec tests for Puppet 4.10


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 3.9.0-0
changelog:
  - Added a 'login_defs' structured fact that returns a hash of all values in
    '/etc/login.defs' with a default 'uid_min' and 'gid_min'


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 3.9.0-0
changelog:
  - Updated the simplib::ldap::domain_to_dn function to allow users to choose
    whether they want to upcase or downcase the LDAP attributes to work around
    different system bugs


author: Maintenance
changelog:
  0.1-10
  - Forced permission and mode setting on the /etc/puppet/environments/simp/modules/site/files
    directory.


author: Maintenance
changelog:
  0.1-11
  - Updated the files list to explicitly name the user/group of the directories.
    For some reaons, %defattr didn't seem to carry down to them properly.


author: Maintenance
changelog:
  2.0.0-1
  - Updated the spec file to add in the 'lib' directory and set the directory
    permissions more cleanly.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.0.0-0
changelog:
  - Use simp_options module for global catalysts
  - Use strongly typed parameters
  - Rename defined type ssh::client::add_entry to ssh::client::host_config_entry


author: Nick Miller <nick.miller@onyxpoint.com> - 6.0.1-0
changelog:
  - Changed the default UsePrivilegeSeparation setting in sshd_config to use the
    vendor default of 'sandbox'
  - Changed the default value of simp_options::trusted_nets to ['ALL'] to prevent
    permanent lockouts when a console isn't available.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.1.0-0
changelog:
  - Reverted 'ssh::server::conf::trusted_nets' to 'ALL' by default to prevent
    lockouts from cloud systems


author: Nicholas Hughes - 6.1.0-0
changelog:
  - Set permissions back to what the RPM sets and security scans expect
    - /etc/ssh/moduli
    - /var/empty/sshd
    - /var/empty/sshd/etc
    - /var/empty/sshd/etc/localtime


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.2.0-0
changelog:
  - Convert internally-used Puppet 3 functions to Puppet 4
    - ssh_config_bool_translate is now ssh::config_bool_translate
    - ssh_format_host_entry_for_sorting now ssh::format_host_entry_for_sorting
  - Create Puppet 4 versions of externally-used Puppet 3 functions and
    mark the Puppet 3 functions as deprecated. They will be removed in
    a later release.
    - ssh_autokey should be replaced with ssh::autokey
    - ssh_global_known_hosts should be replaced with ssh::global_known_hosts


author: Nick Miller <nick.miller@onyxpoint.com> - 6.3.0-0
changelog:
  - If the host has joined an IPA domain, set
    GSSAPIAuthentication to 'yes' in the ssh server and client
    configuration files.


author: Chris Tessmer <chris.tessmer@onyxpoint.com> - 6.4.0-0
changelog:
  - Re-implemented `ssh::client::host_config_entry` using `ssh_config`:
    - Users can now customize additional SSH client options
    - Customizing ssh_config is consistent with sshd_config
    - Tweaked Augeas lens `ssh.aug` to handle `HostKeyAlgorithms` correctly
    - No change to the module's API
    - Removed concat + .erb templates from old implementation
  - Fixed idempotency bug with `/var/empty/sshd/etc/localtime`
    - Removed vestigial SIMP-1143 workaround from acceptance tests
  - Fixed errors in README.md
    - Ciphers and Usage sections rewritten and verified, with tests
    - Added new environment variable `SIMP_SSH_report_dir` to acceptance tests
      to validate ciphers in README
    - Documented solution to SIMP-4440 and added acceptance test
  - Removed cruft:
    - Removed grub from metadata.json and .fixtures.yml because nothing uses it
    - Removed NSCD-related cruft (/etc/pam_ldap.conf) from ancient ldap code


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 6.4.2-0
changelog:
  - Added some variables for sshd_config to meet STIG requirements.
    Most are just confirmation of defaults with the exception of
    ClientAliveInterval and ClientAliveMaxCount which have
    been set to activate Client Alive checks.
  - Added compliance tests to install setting from compliance
    markup module and then run inspec tests to check for compliance.
  - Update version range of auditd dependency in metadata.json


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.4.3-0
changelog:
  - By default, do not specify the obsolete RhostsRSAAuthentication
    configuration parameter in sshd_config on systems running openssh 7.4
    or later.  Beginning with openshh 7.4, sshd emits an error message when
    this parameter is present in sshd_config.


author: Bryan Howard <bryan@alumni.caltech.edu> - 6.4.4-0
changelog:
  - PermitRootLogin accepts more values than 'yes' and 'no'. Add
    support for 'without-password', 'prohibit-password', and
    'forced-commands-only'.
  - It was not possible to set PasswordAuthentication to 'no'
    because the conditional treated false the same as undef, which are
    intended to be different.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.4.4-0
changelog:
  - Added a Ssh::PermitRootLogin data type
  - Updated tests
  - Added a check to fail on EL6 if 'prohibit-password' is set since it is not
    allowed on that platform.


author: Zach <turtles.be.the.best@gmail.com> - 6.5.0-0
changelog:
  - Altered 00_default_spec.rb to stop deleting all ssh keys in test
  - Replaced puppet_environment with puppet_collection in nodesets


author: Nick Miller <nick.miller@onyxpoint.com> - 6.5.0-0
changelog:
  - Added the following package ensure parameters
    - $ssh::client::package_ensure
    - $ssh::server::server_ensure
    - $ssh::server::ldap_ensure
  - Changed the defaults for all package ensures from 'latest' to the following:
    - `simp_options::package_ensure` when that parameter is present
    - 'installed' otherwise


author: Adam Yohrling <adam.yohrling@onyxpoint.com> - 6.5.1-0
changelog:
  - Add ssh_host_keys fact to gather configured `hostkey` values
    from sshd
  - Loop through all hostkeys and manage permissions for security and
    compliance


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.6.1-0
changelog:
  - Use Puppet String in lieu of simplib's deprecated Puppet 3 to_string
  - Use simplib::nets2ddq in lieu of deprecated Puppet 3 nets2ddq


author: Joseph Sharkey <shark.bruhaha@gmail.com> - 6.7.0-0
changelog:
  - Remove Elasticsearch and Grafana
  - Updated tests in support of puppet6, and removed puppet4 support


author: Bob Vincent <pillarsdotnet@gmail.com> - 6.7.0-0
changelog:
  - Added support for the following SSH server configuration parameters:
    - AllowGroups
    - AllowUsers
    - DenyGroups
    - DenyUsers
    - LoginGraceTime
    - LogLevel
    - MaxAuthTries


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.7.0-0
changelog:
  - Switched to selinux_port type for alternate SSH ports
  - Added the ability for users to set custom sshd config entries via a Hash in
    Hiera.
  - Made ListenAddress optional and documented EL6 bug


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.7.1-0
changelog:
  - Replace calls to 'system' with Puppet::Execution.execute in the ssh_autokey
    and ssh::autokeys functions.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.8.0-0
changelog:
  - Add multiple port support
    - The ssh::server::conf::port entry can now take an Array of ports
    - `selinux_port` resources are created for each non-standard entry
  - Update the required version of simp-beaker-helpers to work around Highline
    issues in the compliance acceptance tests.


author: Michael Morrone <michael.morrone@@onyxpoint.com> - 6.8.1-0
changelog:
  - Removed ensure from policycoreutils-python in server config for
    multiple port support to elimate duplicate declaration


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 4.1.1-0
changelog:
  - Moved to Semantic Versioning 2.0
  - Fixed a bug in the LDAP provider where we had
    `ldap_chpass_updates_last_change` as well as
    `ldap_chpass_update_last_change`. These were consolidated into a correct
    single `ldap_chpass_update_last_change` Boolean.
  - Removed RPM dependencies on 'simp-boostrap' and 'puppet' since these are
    technically not necessary for just installing the module.


author: Nick Markowski <nmarkowski@keywcorp.com> - 6.0.0-0
changelog:
  - Updated to use new pki scheme.
  - Application certs now managed in /etc/pki/simp_apps/sssd/x509
  - Strongly typed


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.0.1-0
changelog:
  - Worked around a bug in EL6 where the ldap client library incorrectly handles
    128 bit ciphers in the cipher list


author: Nick Markowski <nmarkowski@keywcorp.com> - 6.0.3-0
changelog:
  - Sssd::DebugLevel now handles all variants specfied in sssd.conf man page
  - All instances of debug_level are now typed as Sssd::DebugLevel


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.1.0-0
changelog:
  - Enforce limits set in /etc/login.defs for uid_min and uid_max by default and
    fall back to something sensible for SSSD


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.1.0-0
changelog:
  - Added sssd class option to automatically configure SSSD for an IPA
    domain, when the host is joined to an IPA domain.


author: Nick Miller <nick.miller@onyxpoint.com> - 6.1.0-0
changelog:
  - Some template and concat changes to make debugging the module easier
    - Add headers to more easily diagnose where to stick params
    - Order the concat sections
  - Add some missing params from sssd::provider::ad
    - default_shell
    - dyndns_update
    - fallback_homedir
    - krb5_realm
    - krb5_store_password_if_offline
    - ldap_schema


author: Nick Miller <nick.miller@onyxpoint.com> - 6.1.2-0
changelog:
  - Avoid changing the permissions from the vendored RPM
    - /etc/sssd/ owner is no longer managed
    - /etc/sssd/ perms went from 0640 to 0711
    - /etc/init.d/sssd went from 0754 to 0755 on EL6
  - Update version range of auditd dependency in metadata.json
  - Cleanup requires in metadata.json
  - Cleanup unneeded fixtures and update CI assets


author: Adam Yohrling <adam.yohrling@onyxpoint.com> - 6.1.3-0
changelog:
  - Added ldap_use_tokengroups, ldap_group_objectsid, ldap_user_objectsid to sssd::provider::ad
  - Updated required version of puppetlabs-stdlib to 4.19.0 since fact function is used


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.1.3-0
changelog:
  - Fixed a bug in which the ldap_account_expire_policy setting
    for the LDAP provider could not be configured to use the system
    default. Now, when sssd::provider::ldap::ldap_account_expire_policy
    is set to '', that configuration parameter will not be written
    to the sssd configuration file. This allows the system default to
    be applied.
  - Fixed a bug in which any boolean setting for the LDAP provider
    configuration could not be configured to be 'false'.
  - Fixed bugs in which sssd::provider::ldap::debug_timestamps and
    sssd::provider::ldap::ldap_search_timeout were erroneously typed to
    be strings, instead of a Boolean and an Integer, respectively.
  - Fixed bugs in which ad_enable_dns_sites, ad_enable_gc settings,
    dyndns_update, dyndns_update_ptr, krb5_use_enterprise_principal,
    and ldap_idmap_autorid_compat settings for the AD provider could
    not be configured to be 'false'.
  - Fixed bugs in which ad_gpo_map_interactive, ad_gpo_map_remote_interactive,
    ad_gpo_map_network, ad_gpo_map_batch, ad_gpo_map_service, ad_gpo_map_permit
    and ad_gpo_map_deny settings for the AD provider were incorrectly formatted.
  - Fixed a bug in which the dyndns_iface setting for the AD provider was not
    set from sssd::provider::ad::dyndns_ifaces.


author: Nick Miller <nick.miller@onyxpoint.com> - 6.1.3-0
changelog:
  - Changed $sssd::install::package_ensure from 'latest' to 'installed'
    - It will also respect `simp_options::package_ensure`


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.1.4-0
changelog:
  - Generated a REFERENCE.md
  - Set the 'min_id' settings across the board to '1' to match the sssd defaults
    since they really have nothing to do with the target system's relationship
    with a centralized authentication service.
  - Update the sssd::provider::ldap::ldap_access_order parameter to support the
    ppolicy related options that were added in sssd 1.14.0
    - ppolicy
    - pwd_expire_policy_reject
    - pwd_expire_policy_warn
    - pwd_expire_policy_renew


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.1.5-0
changelog:
  - Change the sssd::provider::ldap::ldap_access_order defaults to
    ['ppolicy','pwd_expire_policy_renew'] by default to prevent accidental system
    lockouts on upgrade.


author: Nick Markowski <nmarkowski@keywcorp.com> - 6.0.0-0
changelog:
  - Updated global catalysts.
  - Refactored the module.
  - Fixed bug whereby 'chroot = false' is written to stunnel.conf when
    selinux is enabled.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.0.0-0
changelog:
  - Moved `stunnel::add` to `stunnel::connection` for syntactic correctness
  - Updated to work with the new IPTables module


author: Nick Markowski <nmarkowski@keywcorp.com> - 6.0.0-0
changelog:
  - Updated pki::copy to use the new scheme.
  - Application certs now managed in /etc/pki/simp_apps/stunnel/x509
  - Removed parameters from README because we are puppet-strings-ified.
  - Removed redundant parameter $libwrap


author: Ryan Russell-Yates, Liz Nemsick - 6.0.1-0
changelog:
  - Flesh out README
  - Remove OBE 'pe' requirement from metadata.json
  - Update puppet version in .travis.yaml


author: Nick Markowski <nmarkowski@keywcorp.com> - 6.1.0
changelog:
  - Added a define, stunnel::instance
    - Creates standalone connections with their own configurations
      and services
    - Adds systemd support
    - Possible to chroot when selinux is permissive/enforcing
    - Backwards compatible with existing stunnel configurations
  - stunnel::connection is unofficially deprecated until the SIMP-7
    release, at which point stunnel::instance will replace
    stunnel::connection
  - Update puppet requirement in metadata.json


author: Nick Miller <nick.miller@onyxpoint.com> - 6.2.0
changelog:
  - Added acceptance test to switch between SELinux enabled and disabled
    - Renamed them to make more sense
  - Updated SysV scripts for safety concerns
  - PKI now is now owned by the proper $setuid
  - Renamed templates to make more sense
  - Manage PID dir in Puppet when possible
    - Fixed bug where PID dir was being created with SELinux contexts
      even when SELinux was disabled
  - Added systemd unit to `connection` for use on EL7 systems
  - Switched tenplates to use a safe name
  - Added support for Puppet 5


author: Nick Miller <nick.miller@onyxpoint.com> - 6.2.1
changelog:
  - Add feature to systemd init script to kill stunnels started from
    the previous version of the module
  - Fixed bug where `stunnel::config::pid` was being ignored


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.3.0
changelog:
  - Isolated the 'instance' logic away from the 'connection' logic
  - Added a private 'monolithic' class that arranges everything properly for the
    legacy stunnel connections
  - Ensure that 'instances' and 'connections' do not conflict by using a
    'reserve_port' class
  - Add a native type that will clean up all instances that would be randomly
    created by the 'stunnel::instance' defines and will come before both legacy
    and new stunnel connections so that we do not have random left over services
    that may conflict with new services


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.3.0
changelog:
  - Fixed bug in which the stunnel systemd pre-exec script failed to
    execute completely, because one command did not have a fully
    qualified path.
  - Reworked stunnel systemd pre-exec scripts to only emit error
    messages when errors have occurred.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.3.0
changelog:
  - Ensure init.d script is absent if systemd system because puppet
    was finding it and running it and setting permissions on root to
    stunnel:stunnel.
  - Ensure pid file name is not left undefined to prevent unplanned results.
  - Added check to make sure chroot has not evaluated to '/'.


author: Nick Miller <nick.miller@onyxpoint.com> - 6.3.1
changelog:
  - Added two new parameters to the stunnel::instance define:
    - systemd_wantedby: sent to the WantedBy systemd unit install directive
    - systemd_requiredby: sent to the RequiredBy systemd unit install directive
    - These should allow ordering during boot. For example, if you have NFS set up
      over stunnel, you want stunnel to start before NFS.
  - Fixed the systemd startup scripts to properly pre-create the PID directory if
    required


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 6.3.2
changelog:
  - Updated selinux settings in acceptance tests to reflect removal of
    simp_options::selinux setting and use selinux::ensure setting.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.3.2
changelog:
  - Fix the service name used by stunnel so that tcpwrappers would not
    incorrectly drop connections.


author: Adam Yohrling <adam.yohrling@onyxpoint.com> - 6.3.3
changelog:
  - Add support for Puppet5
  - Clean up acceptance tests to use facts for hostname, domain
  - Update badges and contribution guide URL in README.md


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.4.0
changelog:
  - Add ability for users to override stunnel::connection and stunnel::instance
    options either globally or by specific identified instance.
  - Fixed stunnel::connection and stunnel::instance template bugs
    - sni is not applicable on EL6
    - retry is only applicable when exec is specified and
      needs to be translated from a boolean to 'yes'/'no'
    - session is only applicable on EL6


author: Michael Morrone <michael.morrone@onyxpoint.com> - 6.4.1
changelog:
  - If statement evaluating boolean parameter prevented RNDoverwrite being
    set to 'no'. Fixed logic, updated tests, and changed default value
    to maintain default behavior.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.4.2
changelog:
  - Use simplib::nets2ddq in lieu of simplib's deprecated Puppet 3 nets2ddq
  - Use Puppet Integer instead of simplib's deprecated Puppet 3 to_integer
  - Use Puppet String instead of simplib's deprecated Puppet 3 to_string
  - Use simplib::validate_array_member in lieu of simplib's deprecated
    Puppet 3 validate_array_member


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 5.0.1-0
changelog:
  - Fixed the validation command on the concat resource to actually validate the
    temp file prior to putting it in place


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 5.0.6-0
changelog:
  - Added minimum size for sudo::user_specification::hostlist, because an
    empty list is not permitted.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 5.1.0-0
changelog:
  - Replaced all references to 'sudosh' with 'su' to reduce future confusion as
    we move away from using sudosh.


author: Nicholas Markowski <nicholas.markowski@onyxpoint.com> - 5.1.0-0
changelog:
  - Added support for Puppet 5 and OEL
  - Modified uspec template to handle the RedHat OS family instead of just RHEL
    or CentOS


author: Steven Pritchard <steven.pritchard@onyxpoint.com> - 5.2.0-0
changelog:
  - Allow additional options in sudo::user_specification
  - Add Puppet 6 support
  - Remove Puppet 4 support
  - Allow puppetlabs/stdlib < 7


author: Nick Markowski <nmarkowski@keywcorp.com> - 6.0.1-0
changelog:
  - Updated logrotate to use new lastaction API
  - Update puppet requirement and remove OBE pe requirement in metadata.json


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 1.1.0-0
changelog:
  - Added a 'verbose' option to svckill which will enumerate all actions on
    services if enabled.
  - Ensure that all relevant messages are passed back via the 'to_s' method so
    that PuppetDB can obtain a full report.


author: Nick Miller, Ryan Russell-Yates, Liz Nemsick - 3.1.1-0
changelog:
  - Add acceptance test for symlinked services
  - Flesh out README
  - Remove OBE 'pe' requirement from metadata.json
  - Update puppet version in .travis.yaml


author: Trevor Vaughan - 3.2.0-0
changelog:
  - Enabled the new, kinder, svckill by setting the default mode to 'warning'
  - Added a `svckill::enable` parameter to be able to disable svckill from Hiera
    easily


author: Nick Markowski <nmarkowski@keywcorp.com> - 3.2.1-0
changelog:
  - In the service kill provider, not all services queried by 'Name'
    with systemctl would return a name.  That caused a break in symlink
    logic, rendering a majority of aliases to remain undetected.  Error
    detection has been added and the symlink logic has been re-worked.


author: Nick Markowski <nmarkowski@keywcorp.com> - 3.2.1-0
changelog:
  - Implemented simplib::knockout on the ignore list so users can
    remove items in the default list via hiera.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 3.2.1-0
changelog:
  - Fix bug whereby svckill provider's insync_values? emits
    'Unknown failure' message during normal operation.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 3.2.4-0
changelog:
  - Fix bug in which svckill provider can fail on a server for which
    there are are no aliased, SystemD services.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 3.2.6-0
changelog:
  - Add simp_client_bootstrap service to the ignore list.  If this
    is omitted from the ignore list, svckill will kill the bootstrap
    process of SIMP clients, while they are boostrapping the system.


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 3.3.0-0
changelog:
  - Added Redhat 7.5 services to default service ignore list.
  - Updated ruby version to 2.4.4
  - Updated Gemfile to ask for puppet 5
  - Update badges and contribution guide URL in README.md


author: Liz Nemsick <lnemsick.simp@gmail.com> - 3.3.1-0
changelog:
  - Expanded the upper limit of the concat and stdlib Puppet module versions
  - Fixed bad URLs in the README.md


author: Nick Miller <nick.miller@onyxpoint.com> - 0.1.2-0
changelog:
  - Updates the metadata to support Puppet 5 and Oracle Linux
  - Migrates acceptance tests to suites
  - Adds OEL nodeset
  - Update module assets
  - Update badges and contribution guide URL in README.md


author: Jim Anderson <thesemicolons@protonmail.com> - 0.1.4-0
changelog:
  - Changed location of ruby in dynamic_swappiness.erb to point to the
    SIMP provided version instead of an OS provided version.
  - Updated expected templates in Travis CI checks.


author: Nick Markowski <nmarkowski@keywcorp.com> - 2.1.0-0
changelog:
  - Updated module for puppet3/hiera compatibility, and optimized code for lint tests,
    and puppet-rspec.
  - Removed tcpwrappers::tcpwrappers_allow


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 3.0.0-0
changelog:
  - Updated to use an array for the allow and to use the new ipaddresses function
    in common to provide all local addresses to the initial line.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 3.0.0-1
changelog:
  - Updated to not cast lpattern to an Array in tcpwrappers.allow.erb
    for compatibility with Ruby 2.


author: Nick Miller <nick.miller@onypoint.com> - 6.1.0-0
changelog:
  - Add support for Puppet 5 and OEL
  - Added $package_ensure parameter
    - Changed the package from 'latest' to 'installed'
    - It will also respect `simp_options::package_ensure`


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.1.1-0
changelog:
  - Use simplib::ipaddresses() in lieu of ipaddresses(), a deprecated
    simplib Puppet 3 function.
  - Expanded the upper limit of the concat and stdlib Puppet module versions
  - Fixed URLs in the README.md


author: Joseph Sharkey <shark.bruhaha@gmail.com> - 6.1.2-0
changelog:
  - Use simplib::bracketize in lieu of deprecated Puppet 3 bracketize
  - Fix template bug that prevented some IPv6 addresses from being
    properly formatted in /etc/hosts.allow.


author: Nick Markowski <nmarkowski@keywcorp.com> - 4.1.1-0
changelog:
  - Inclusion of FIPS in the initrd kickstart option list is now optional.
    By default, we no longer set fips=1 in initrd.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.1.0-0
changelog:
  - Added support for UEFI PXEboot.
    - Added tftpboot::linux_model_efi.
      Added tftpboot::assign_host_efi.
    - Tested primarily on CentOS 7 (grub2). Testing of CentOS 6 UEFI
      boot with legacy grub is **pending**.
  - **Moved** the tftproot root directory from /tftpboot to /var/lib/tftpboot
    to satisfy the STIG RHEL-07-040520 check.
  - Added tftpboot::tftpboot_root_dir to allow users to override
    the new default root directory (e.g., to set it back to /tftpboot).
  - Added tftpboot::linux_install_dir and tftpboot::package_ensure
    to allow more fine-grained control of this module.
  - Explicitly set selinux context on tfptboot files/directories to
    tftpdir_t in order to restrict their access to read-only tftpd
    operation.
  - Internally, refactored configuration to use small, private classes.


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 5.0.3-0
changelog:
  - Pulled latest fixes from saz time zone.  Needed for Centos 7.5 which
    requires localtime to be a link.


author: Nick Miller <nick.miller@onyxpoint.com> - 0.2.0-0
changelog:
  - Added a feature to manage the PKCS#11 slot provided by the TPM
  - Also added a class that takes advantage of it


author: Nick Miller <nick.miller@onyxpoint.com> - 0.2.1-0
changelog:
  - Added a check to the ima_log_size fact to make sure that the file
    needed exists before executing


author: Nick Miller <nick.miller@onyxpoint.com> - 1.1.0-0
changelog:
  - Improvments to the facts:
    - Add tests for following facts:
      - tpm
      - ima_log_size
      - has_tpm
    - Confine tpm fact on the existance of the `tpm-tools` package
    - Migrate to the built in facter timeout
  - Improvements to the `tpm_ownership` provider
    - Added instances feature
      - run `puppet resource tpm_ownership` and see the resource
    - New properties to the type to reflect system state
    - Changed default owner_pass to 'well-known'
    - Removed 'ensure' parameter in favor of the 'owned' param
    - Improved documentation
  - Improvements to the `tpm::ownership` class
    - Added 'owned' parameter to pass to the tpm_ownership type
  - New `tpm::tboot` class to enable Trusted Boot
    - See `tpm::tboot` for details
    - Automatically lock the kernel package and other kernel related packages to
      avoid automatically invalidating launch policy
  - Depend on augeasproviders_grub instead of generic and deprecated
    augeasproviders


author: Nick Miller <nick.miller@onyxpoint.com> - 1.1.1-0
changelog:
  - Updated to support Puppet 5
  - IMA policy service
    - Moved the import_ima_rules systemd unit file from /usr/systemd to /etc/systemd
      on systemd based systems
    - Service is now stopped, but enabled, so will only take affect at reboot,
      not during puppet run


author: Nick Miller <nick.miller@onyxpoint.com> - 1.2.0-0
changelog:
  - tpm::ima::policy was not previously callable from tpm::ima
  - tpm::ima::policy will now disable many default IMA checks by default


author: Michael Morrone <michael.morrone@onypoint.com> - 3.1.0-0
changelog:
  - Removed direct module support for IMA, as that functionality has been
    ported to the ima module.  Instead, for backward compatibility, this
    module now uses the ima module, when tpm::ima is set to true.


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 3.1.0-0
changelog:
  - Added support for tboot V1.9.6 and removed support for tboot.1.9.4.
    Use pupmod-simp-tpm 1.1.0 if tboot v1.9.4 is required.
  - Made creating the VLP and LCP optional because  they don't work in
    tboot v1.9.6.
  - Tboot V1.9.7 was released on Sept 06, 2018 but not packaged for Redhat.
    Tested with a locally compiled version and the creation of the policy
    was fixed in that version.
  - Added check for 20 character owner passwords because they are required.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 3.1.1-0
changelog:
  - Use simplib::passgen() in lieu of passgen(), a deprecated simplib
    Puppet 3 function.
  - Expanded the upper limits of the stdlib and yum Puppet module versions


author: Liz Nemsick <lnemsick-simp@gmail.com> - 0.1.1
changelog:
  - Confine tpm2 fact on the presence of TPM 2 tools required
    for that fact evaluation
  - Use simplib::passgen() in lieu of passgen(), a deprecated simplib
    Puppet 3 function.
  - Update the upper bound of stdlib to < 6.0.0
  - Update a URL in the README.md


author: Liz Nemsick <lnemsick.simp@gmail.com> - 0.2.0
changelog:
  - Removed Puppet 4 support
  - Added Puppet 6 support
  - Added puppetlabs-stdlib 6 support
  - Maintenance: removed OBE build/rpm_metadata/requires


author: Nick Markowski <nmarkowski@keywcorp.com> 4.1.0-0
changelog:
  - Updated module for puppet3/hiera compatability, optimized code for lint tests,
    and added puppet-rspec tests.


author: Chris Tessmer <chris.tessmer@onypoint.com> - 4.1.0-4
changelog:
  - migration to simplib and simpcat (lib/ only)
  - Fixed a set of bugs that were introduced to the 'job.erb' template.
  - Code cleanup


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.0.0-0
changelog:
  - Use simp_options module for global catalysts
  - Use strongly typed parameters
  - Fix bug whereby optional, respawn limit was not properly specified
    in upstart jobs.
  - Refined upstart::job::sys_limit validation to reject non-integer numbers.


author: Nicholas Markowski <nicholas.markowski@onyxpoint.com> - 6.0.3-0
changelog:
  - Added Puppet 5 and OEL support
  - Dropped support for Hiera v4.  Dependency auditd has dropped support
    for Hiera v4, causing Puppet 4.7 tests to fail in this module.
  - Update badges and contribution guide URL in README.md


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.0.4-0
changelog:
  - Use Simplib::Umask data type in lieu of validate_umask(),
    a deprecated simplib Puppet 3 function.
  - Update the upper bound of stdlib to < 6.0.0
  - Update a URL in the README.md


author: Nick Miller <nick.miller@onyxpoint.com> - 0.0.1
changelog:
  - Initial release of module
  - This module is a collection of conf files regarding users and user creation.
    - Most of the content used to be in simplib


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.1.0
changelog:
  - Provided the ability to simply add shells to /etc/shells
  - Removed all entries from /etc/securetty by default to match the latest
    standard best practices. This removed ZSH.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.1.1
changelog:
  - Fixed useradd::libuser::defaults_crypt_style to only be a String of the
    allowed values
  - Ensure that the 'modules' field is not printed if the passed Array is empty
  - Ensure that defaults_hash_rounds_min is less than defaults_hash_rounds_max
    and that both are within an allowed range
  - Update useradd::login_defs::pass_min_len to 15 to match the rest of the module updates


author: Brandon Riden <brandon.riden@onyxpoint.com> - 0.2.0
changelog:
  - Fix bug in libuser.conf where userBranch was referencing groupbranch variable
  - Added/fixed author on all manifests
  - Created Acceptance test
  - Updated spec/spec_helper_acceptance.rb
  - Added Managed by Puppet comment to all file templates
  - updated default nodeset
  - Added notes to login_defs.pp regarding min and max passwd length
  - Cleaned up documentation and made style changes


author: Brandon Riden <brandon.riden@onyxpoint.com - 0.2.0
changelog:
  - Allow users to specify colors as strings instead of ansi codes in sysconfig/init
  - Updated sysconfig_init.pp to reflect these changes as well as add notes
  - Updated template to convert color strings to ansi code


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.2.1
changelog:
  - Set the minimum and maximum UID and GID allowed onto the system to the
    default defined in /etc/login.defs or a sensible default if not otherwise
    specified


author: Chris Tessmer <chris.tessmer@onyxpoint.com> - 6.0.1-0
changelog:
  - Removed unecessary code and deps after major dep releases
  - Locked versions of all build and test deps


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.0.3-0
changelog:
  - Ensure that the default VNC sessions set the IPv4 flag
  - Ensure that the default VNC sessions set the banner to /dev/null


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 7.0.0-0
changelog:
  - Remove automatic setting of the XDMCP setting in GDM - BREAKING
    - It was determined that this should be something that the administrator
      should explicitly opt into by setting it in the GDM module settings via
      Hiera since it has security implications


author: Nick Miller <nick.miller@onyxpoint.com> - 7.0.0-0
changelog:
  - Add support for Puppet 5 and OEL
  - Convert docs to yard tags and add reference.md
  - Added $package_ensure parameters to vnc::server and vnc::client
    - Changed the packages from 'latest' to 'installed'
    - Each will also respect `simp_options::package_ensure`


author: Liz Nemsick <lnemsick.simp@gmail.com> - 7.0.1-0
changelog:
  - Use Simplib::Port data type in lieu of deprecated, simplib
    Puppet 3 validate_port()
  - Use new Vnc::Geometry data type in lieu of deprecated,
    stdlib validate_re()
  - Updated a URL in the README.md


author: Liz Nemsick <lnemsick.simp@gmail.com> - 7.0.0-0
changelog:
  - Use simp_options module for global catalysts
  - Fixed bug whereby manifest would fail to compile if the force_dot_files
    parameter of ::vsftpd::config was set
  - Fixed bug whereby vsftpd.conf configuration values to be set to 'NO'
    were not written out to that file
  - Fixed bug whereby listen configuration parameter for vsftpd.conf was
    not set based on $listen_ipv4 parameter of ::vsftpd
  - Convert to explicit parameter types


author: Nick Markowski <nmarkowski@keywcorp.com> - 7.0.0-0
changelog:
  - New pki scheme
  - Real integers and simplib types implemented
  - Application certs now managed in /etc/pki/simp_apps/vsftpd/x509


author: Liz Nemsick <lnemsick.simp@gmail.com> - 7.1.0-0
changelog:
  - By default, use TLS 1.2 instead of TLS 1.0.
  - Eliminate the use of deprecated validate_net_list() through
    better strongly-typed parameters for IP addresses and hosts.
  - Add CentOS 6 acceptance tests.


author: Nick Miller <Nick.miller@onyxpoint.com> - 7.2.0-0
changelog:
  - Add support for Puppet 5
  - Add reference.md
  - Move user/group management to it's own manifest, allowing for easier
    ordering
  - Added $package_ensure parameter
    - Changed the package from 'latest' to 'installed'
    - It will also respect `simp_options::package_ensure`
  - Add some OEL content but not declaring support for it yet


author: Liz Nemsick <lnemsick.simp@gmail.com> - 7.1.0-0
changelog:
  - By default, use TLS 1.2 instead of TLS 1.0.
  - Eliminated the use of deprecated validate_net_list() through
    better strongly-typed parameters for IP addresses and hosts.
  - Added CentOS 6 acceptance tests.


author: Nick Miller <Nick.miller@onyxpoint.com> - 7.2.0-0
changelog:
  - Added support for Puppet 5
  - Added reference.md
  - Moved user/group management to it's own manifest, allowing for easier
    ordering
  - Added $package_ensure parameter
    - Changed the package from 'latest' to 'installed'
    - It will also respect `simp_options::package_ensure`
  - Added some OEL content but not declaring support for it yet


author: Joseph Sharkey <shark.bruhaha@gmail.com> - 7.2.1-0
changelog:
  - Fixed ordering issue between the kernel module loading for 
    iptables and the service being started
  - Updated tests in support of puppet6, and removed puppet4 support


author: Liz Nemsick <lnemsick.simp@gmail.com> - 4.0.0-0
changelog:
  - Use simp_options module for global catalysts
  - Fix bug in xinetd.service.erb that caused an inadvertant newline between the
    IP address and port in a redirect configuration line in the generated file.
  - Fix bug in xinetd.service.erb in which the instances and mdns configuration
    lines were omitted from the generated file.
  - Fixed bug in xinetd.service.erb in which includedir and include were specified
    within a service declaration and formatted incorrectly.
  - Fixed bug in validation of syslog facility
  - Fixed bugs in validation of ::xinetd $passenv and $disable parameters
  - Fixed bugs in validation of ::xinetd::service $x_id and $rpc_version parameters
  - Minor cleanup


author: Nick Miller <nick.miller@onyxpoint.com> - 4.0.1-0
changelog:
  - Updated data types to use new Simplib types
  - Corrected simp_options lookups to not have a context prefix of '::'


author: Liz Nemsick <lnemsick.simp@gmail.com> - 4.0.2-0
changelog:
  - Update to Puppet 4 custom functions
  - Update puppet requirement and remove OBE pe requirement in metadata.json


author: Liz Nemsick <lnemsick.simp@gmail.com> - 4.1.1-0
changelog:
  - Fixed bug in which the xinetd::disabled parameter would only
    be included in xinetd.conf if the xinetd::no_access parameter
    was not empty.
  - Use Simplib::Umask data type in lieu of validate_umask(),
    a deprecated simplib Puppet 3 function.
  - Use simplib::validate_net_list() in lieu of validate_net_list(),
    a deprecated simplib Puppet 3 function.
  - Use simplib::nets2cidr() in lieu of nets2cidr(),
    a deprecated simplib Puppet 3 function.
  - Expanded the upper limits of the stdlib Puppet module version


author: Orion Poplawski <orion@cora.nwra.com> - 2.07-1
changelog:
  - Update to 2.07 (bug 1159526) fixes:
    CVE-2013-4440 (bug 1020222, 1020223)
    CVE-2013-4442 (bug 1020259, 1020261)


author: Luke Macken <lmacken@redhat.com> - 2.7.6-1
changelog:
  - Update to 2.7.6
  - Run the test suite
  - Add a python3 subpackage
  - Remove obsolete buildroot tag and cleanup


author: Toshio Kuratomi <toshio@fedoraproject.org> - 2.6.0-1
changelog:
  - Update to 2.6.0 which changes some messages thrown by exceptions to match
    with json module in python3.3 stdlib.  Probably safe for older releases but
    the python3 version there is 3.2 so there's also not any real need yet.


author: Toshio Kuratomi <toshio@fedoraproject.org> - 3.1.0-1
changelog:
  - Update to 3.1.0 in Rawhide.
  - Build the python3 subpackage
  - Update to new-style filtering of provides


author: Melissa Stone <melissa@puppetlabs.com> - 0.4.1-3
changelog:
  - Use RbConfig rather than Config to find sitelibdir
  - Use vendorlibdir and vendorarchdir for rhel 7


author: Steve Traylen <steve.traylen@cern.ch> - 0.9.16-1
changelog:
  - New updstream 0.9.16, upstream moved to source and rubygems.org
  - Update to ruby package guidelines.
  - Fix for EPEL7.


author: Moses Mendoza <msoes@puppetlabs.com> - 0.6.2-1
changelog:
  - Package rgen as a library. The tarball is created from a `gem unpack`
  - of rubygem-rgen and tarring up the resulting contents.


author: Ryan McKern <ryan.mckern@puppetlabs.com> - 1:2.2.0-2
changelog:
  - Bump release to version 1:2.2.0 in order to override a broken 2.3.2 package
    that was shipped and later yanked. The incompatable package broke user resources,
    and was removed from distribution on Feb 19 2014.
  - "Epoch is forever"


author: Melissa Stone <melissa@puppetlabs.com> - 1.6.2-1
changelog:
  - Update to upstream latest v1.6.2
  - Rework spec file to comply with modern fedora requirements
  - Stop building doc package


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 1.8.2-0
changelog:
  - Updated gem to 1.8.2
  - Removed pinning to specific version of puppetserver
  - Removed obsolete dependency on blankslate
  - Added 'puppetserver' to the gem name to not conflict with native packages


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.2.0-0
changelog:
  - Updated gem to 0.2.0
  - Removed pinning to specific version of puppetserver
  - Updated dependency on parslet
  - Added 'puppetserver' to the gem name to not conflict with native packages


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.2.0-1
changelog:
  - Obsolete rubygem-puppetserver-blankslate <= 2.1.2.4
    - This is not wonderful, but the trade off between a clean upgrade to the
      latest puppetserver and having the blankslate gem hanging around seems
      worthwhile.


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.598-24
changelog:
  - Rebased to Ruby 2.0.0-p598.
    * Remove Patch19: ruby-2.0.0-p247-Make-stable-Gem-Specification.files-in-
        default-.gems.patch; subsumed
    * Remove Patch20: ruby-2.1.1-fix-test-failures-due-to-expired-certs.patch;
        subsumed
    * Remove Patch21: ruby-2.1.0-test_aes_gcm_wrong_tag-Dont-use-String
        -succ.patch; subsumed
    * Remove Patch22: ruby-2.2.0-fix-error-with-tzdata.patch; subsumed
    Resolves: rhbz#1071187
  - Incorporates fixes for CVE-2014-8080 and CVE-2015-8090.
    Resolves: rhbz#1164000
  - Fix for Proxy Realm feature.
    Resolves: rhbz#1122140
  - Fix off-by-one stack-based buffer overflow in the encodes() function
    (CVE-2014-4975).
    Related: rhbz#1164000


author: Pavel Valena <pvalena@redhat.com> - 2.0.0.648-26
changelog:
  - Rebase to Ruby 2.0.0-p648
    Resolves: rhbz#1197720, rhbz#1298282, rhbz#1258863
    * Remove Patch18: ruby-2.0.0-p247-Revert-mkmf.rb-prefix-install_dirs-only-
        with-DESTDIR.patch; subsumed
    * Remove Patch23: ruby-openssl-wrap-cipher-fix.patch; subsumed
    * Remove Patch25: ruby-2.0.0-p607-DNS-Resolv-fall-back-if-canonicalization-
        fails.patch; subsumed
  - Remove tests depending on europe/moscow to avoid failures due to tzdata change
    https://github.com/eggert/tz/commit/8ee11a301cf173afb0c76e0315b9f9ec8ebb9d95
  - Add checks for systemtap, abrt hook and rubygems version
  - Fix significant hash table performance slowdown on ppc64le
    Resolves: rhbz#1163032
  - Support in no_proxy for domain names with whitespaces and leading dots
    Resolves: rhbz#1300433


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.648-30
changelog:
  - Fix test_npn_protocol_selection_ary and test_npn_protocol_selection_enum
    failures with newest openssl.
    Resolves: rhbz#1416123
  - Add gemspec_add_dep and gemspec_remove_dep macros.
  - Extend 'gem_' macros for pre-release version support.
    Resolves: rhbz#1397390
  - Make symlinks for json gem.
    Resolves: rhbz#1308992


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.648-31
changelog:
  - Fix unsafe object deserialization in RubyGems (CVE-2017-0903).
    * ruby-2.4.3-CVE-2017-0903-Fix-unsafe-object-deserialization
        -vulnerability.patch
    Resolves: CVE-2017-0903
  - Fix an ANSI escape sequence vulnerability (CVE-2017-0899).
    Resolves: CVE-2017-0899
  - Fix a DOS vulernerability in the query command (CVE-2017-0900).
    Resolves: CVE-2017-0900
  - Fix a vulnerability in the gem installer that allowed a malicious gem
      to overwrite arbitrary files (CVE-2017-0901).
    Resolves: CVE-2017-0901
  - Fix a DNS request hijacking vulnerability (CVE-2017-0902).
    * ruby-2.2.8-lib-rubygems-fix-several-vulnerabilities-in-RubyGems.patch
    Resolves: CVE-2017-0902
  - Fix buffer underrun vulnerability in Kernel.sprintf (CVE-2017-0898).
    * ruby-2.2.8-Buffer-underrun-vulnerability-in-Kernel.sprintf.patch
    Resolves: CVE-2017-0898
  - Escape sequence injection vulnerability in the Basic
      authentication of WEBrick (CVE-2017-10784).
    * ruby-2.2.8-sanitize-any-type-of-logs.patch
    Resolves: CVE-2017-10784
  - Arbitrary heap exposure during a JSON.generate call (CVE-2017-14064).
    * ruby-2.2.8-Fix-arbitrary-heap-exposure-during-a-JSON.generate-call.patch
    Resolves: CVE-2017-14064
  - Command injection vulnerability in Net::FTP (CVE-2017-17405).
    * ruby-2.2.9-Fix-a-command-injection-vulnerability-in-Net-FTP.patch
    Resolves: CVE-2017-17405
  - Buffer underrun in OpenSSL ASN1 decode (CVE-2017-14033).
    * ruby-2.2.8-asn1-fix-out-of-bounds-read-in-decoding-constructed-objects.patch
    Resolves: CVE-2017-14033
  - Command injection in lib/resolv.rb:lazy_initialize() allows arbitrary code
      execution(CVE-2017-17790).
    * ruby-2.5.0-Fixed-command-Injection.patch
    Resolves: CVE-2017-17790


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.648-32
changelog:
  - Add Psych.safe_load
    * ruby-2.1.0-there-should-be-only-one-exception.patch
    * ruby-2.1.0-Adding-Psych.safe_load.patch
    Related: CVE-2017-0903
  - Disable Tokyo TZ tests broken by recen tzdata update.
    * ruby-2.5.0-Disable-Tokyo-TZ-tests.patch
    Related: CVE-2017-0903


author: Liz Nemsick <lnemsick.simp@gmail.com> - 1.0.20-0
changelog:
  - Fix array formatting bugs present when 'simp config' is used with
    Ruby 1.8.7.
  - Fix bug with processing of yes/no item defaults, when the
    non-interactive configuration mode of 'simp config' is enabled.
  - Print out a summary of actions taken by 'simp config'.
  - Adjust 'simp config' processing to ensure any hiera changes are
    made to the site yaml file, not just the template yaml file
    delivered with SIMP.
  - Refine 'simp config' configuration descriptions and other output.
  - Improved error handling.
  - Expand tests.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 1.0.21-0
changelog:
  - Updated the Rakefile to use the simp-rake-helpers file
  - Updated the SIMP command line to install to /usr/share/simp/ruby and to use
    the AIO ruby if present and the system ruby otherwise.
  - Ensure that the 'simp' executable is installed to the actual system bindir


author: Nick Markowski <nmarkowski@keywcorp.com> - 2.0.0
changelog:
  - Bootstrap now curls the puppetserver on the masterport (not the ca_port)
    to check if the puppetserver is running.


author: Nick Markowski <nmarkowski@keywcorp.com> - 3.0.0
changelog:
  - Updated simp bootstrap for SIMP-6:
  -  There is now only one tagged run, simp + pupmod. The puppetserver
     is fully configured at the end of the run, clearing up all
     messy restarts of the service during the rest of the bootstrap.
  -  For now, all other base modules are two run idempotent, so tagless
     runs have been limited to two in number.
  -  Now re-runable. All modified files are backed up.
  -  Lock out the puppet agent to ensure the cron job does not kick
     off during bootstrap.
  -  Wait for running puppet agents to complete before bootstrapping;
     users can optionally specify --kill_agent.
  -  By default, users are prompted to keep or remove puppetserver certs.
     Added --[no]-remove_ssldir so users can run bootstrap without
     interraction.
  -  If puppetserver is configured to listen on 8150, the process is
     no longer killed at the end of bootstrap.
  -  More verbose output, including debug mode.  Text is organized and
     colorized.
  -  Bootstrap log now timestamped.
  -  Introduced a safe mode to ignore interrupts, toggle with --unsafe.
  -  Added in general error handling.
  -  Removed puppet 3 cruft.
  -  Tracking is fabulous.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 4.0.0
changelog:
  - simp passgen updates:
    - Fixed bug that prevented removal of passwords by simp passgen
      (call to non-existent show_password())
    - Updated simp passgen operation to reflect environments
    - Added simp passgen command-line option to specify whether the
      user will be prompted for backup operations when a password is
      set.
    - Added spec tests.
  - simp config updates:
    - Adjust spacing of logged output


author: Liz Nemsick <lnemsick.simp@gmail.com> - 4.0.0
changelog:
  - simp config updates:
    - Add query for svckill::mode to simp scenario
    - Refactored generation of scenario configuration YAML, to
      support, more readily, the different configuration requirements
      of each scenario.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 4.0.0
changelog:
  - simp config updates:
    - When SIMP was not installed via RPM, warn operator about
      potential system lockout and then prevent 'simp bootstrap'
      from running, until the operator manually verifies the
      problem has been addressed/is not an issue.
    - Update location to FakeCA


author: Liz Nemsick <lnemsick.simp@gmail.com> - 4.0.0
changelog:
  - simp config changes:
    - Reworked YUM-related queries to reflect changes to simp::yum.
      Now, for non-ISO installs, you have the option to set up
      SIMP repos that pull from SIMP internet repositories.
      Otherwise, the configuration of YUM repositories for the
      SIMP server and SIMP clients is left to the installer.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 4.0.0
changelog:
  - simp bootstrap update:
    - Tweak post-bootstrap text to remove instructions to run
      puppet and to make it more clear that the user must reboot.
    - Do not tell user existing certificates have been preserved,
      when none exist.


author: Nick Markowski <nmarkowski@keywcorp.com> - 4.0.1
changelog:
  - simp config update:
    - We noticed inconsistent behavior when spawning commands with
      pipes, particularly a pipe to xargs.  Item execute has been
      re-tooled to reject pipes, and provide users with a way to
      chain commands while mitigating code flux due to change in API.
    - Added the run_command method to Cli::Config::Item
    - Action items updated:
      - update_os_yum_repositories_action
      - check_server_yum_config_action


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 4.0.2
changelog:
  - Changed chown command to also handle PE
    - Thanks to Bryan Belanger for the PR!
  - Made the Puppetserver tmp dir code consistent with the rest of the chmods


author: Liz Nemsick <lnemsick.simp@gmail.com> - 4.0.3
changelog:
  - Fix bug in hostname validation that prevented complex hostnames
    such as 'xyz-w-puppet.qrst-a1-b2' to fail validation.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 4.0.5
changelog:
  - Clarify confusing svckill::mode description provided by simp config
  - Use modern OS facts in simp config, instead of legacy facts that
    require LSB packages to be installed.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 4.0.5
changelog:
  - Fix bug in which simp config failed to set the GRUB password
    on a CentOS 6 system booted using EFI


author: Liz Nemsick <lnemsick.simp@gmail.com> - 4.0.5
changelog:
  - Set the ownership and permissions of files generated by simp cli,
    instead of allowing them to be set to those of the root user.
    This is part of the fix to the failure of SIMP to bootstrap on a
    system on which root's umask has already been restricted to 077.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 4.0.5
changelog:
  - Prior to bootstrap, we now ensure that the site.pp and site module
    code is valid so that we don't have confusing delays after waiting for
    multiple failing Puppet runs.
  - Clarified the message when bootstrap is locked
  - Ensured that backtraces are not displayed to the user on known
    bootstrap failure cases


author: Liz Nemsick <lnemsick.simp@gmail.com> - 4.1.0
changelog:
  - 'simp config' bug fixes
    - Fixed bug in which '{' and '}' characters in console error messages
      resulted in obscure Ruby parsing failures.
    - Fixed bug in which existing non-local NTP servers configuration
      was not presented to the user as a recommended value for
      simp_options::ntpd::servers.
    - Fixed a bug in simp config in which the grub password could
      be **silently** generated and set when the -f option was used.
      The user would have no way to figuring out the value of the
      grub password in that scenario.
  - 'simp config' enhancements
    - Reworked password entry to act more like traditional Linux password
      changing programs
    - Improved input validation and error handling:
      - Improved password validation. This validation now uses pwscore,
        when available.  cracklib-check is used otherwise.
        **CAUTION**:  Existing passwords may not pass current validation.
      - When interactive operation is permitted, always query the user for
        replacement values for invalid answers provided by file or command
        command line KEY=VALUE input.  Previously, for items that
        'simp config' would normally automatically assign without user
        input, 'simp config' would automatically (and sometimes
        silently), replace the invalid values.  This both hid errors
        and yielded unexpected settings.
      - Verify <password, password hash> pairs provided by file or
        command line KEY=VALUE input are valid.  Previously, a user
        could pre-assign LDAP Bind/Sync passwords that did not match
        their respective password hashes.
      - Log problems with invalid answers provided by file or command
        line KEY=VALUE input when the answer is processed, not when
        it is first read in.  Previously, validation error messages
        were totally disassociated from the values causing the errors.
    - Added an option to disable queries (-D,--disable-queries) whether or
      not an input answers file is being used.  This feature is a
      functioning replacement for the previously removed -ff capability.
    - Deprecated the --non-interactive long name of -f in favor of
      a more accurately-named replacement, --force-defaults.
      --non-interactive will be removed in a future release.
  - 'simp passgen'
    - Fixed bug in which password filenames containing one or more '.'
      characters could not be listed, added, or removed.
    - Added password auto-generation capability to password setting
      operation.
    - Added backup of password salt files, when passwords are backed up.
    - Per security best practices, when a password is updated, now
      removes the salt file corresponding to an old password.
    - Improved password validation. This validation now uses pwscore,
      when available.  cracklib-check is used otherwise.
      **CAUTION**:  Existing passwords may not pass current validation.
  - General updates
    - No longer emit Ruby backtraces for errors for which a backtrace
      provides no additional information.


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 4.1.0
changelog:
  - removed simp_options::selinux references in tests.
  - update setting of grub2 password to use augeausproviders_grub.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 4.2.0
changelog:
  - Stripped trailing whitespace
  - Adjusted bootstrap to detect PE and avoid operations that are detrimental to
    proper operation
  - Made a few adjustments for overall safety
  - Fixed dependency loading for 'highline/import' by clearing the gem cache


author: Liz Nemsick <lnemsick.simp@gmail.com> - 4.3.0
changelog:
  - Update 'simp config' to support environment-specific Hiera 5
    configuration provided by SIMP-6.3.0.
    - Assumes a legacy Hiera 3 configuration, when the 'simp'
      environment only contains a 'hieradata' directory.
    - Assumes a Hiera 5 configuration configuration, when the 'simp'
      environment contains both a 'hiera.yaml' file and a 'data/'
      directory.
    - Fails to run otherwise, as neither stock SIMP configuration
      has been found and 'simp config' cannot safely modify
      hieradata.


author: Chris Tessmer <chris.tessmer@onyxpoint.com> - 4.3.0
changelog:
  - Fixed `simp bootstrap` errors in puppetserver 5+:
    - No longer overwrites `web-routes.conf` (fixes fatal configuration error)
    - No longer adds `-XX:MaxPermSize` for Java >= 8 (fixes warnings at restart)


author: Chris Tessmer <chris.tessmer@onyxpoint.com> - 4.3.0
changelog:
  - `simp config` removes the deprecated Puppet setting `trusted_server_facts`
  - Add `:version` to `Simp::Cli::Utils.puppet_info`


author: Liz Nemsick <lnemsick.simp@gmail.com> - 4.4.0
changelog:
  - Added a `simp bootstrap` option to set the wait time for the
    puppetserver to start during the bootstrap process.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 5.0.0
changelog:
  - Ensure that a FQDN is used when running `simp config`
  - Ensure that a FQDN is set when running `simp bootstrap`
  - Fixed a bug where the web-routes.conf file was not being overwritten with a
    pristine copy. This meant that multiple calls to `simp bootstrap` would fail
    due to leftover CA entries in the file. The error provided is not clear and
    has been provided upstream to Puppet, Inc.
  - Fixed a typo in an info block that would cause 'simp bootstrap' to fail if it
    had already been successfully run.


author: Jim Anderson <thesemicolons@protonmail.com> - 5.0.0
changelog:
  - Added message to bootstrap.rb indicating that puppetserver has been
    reconfigured to listen on a specific port. This message will be
    displayed if the port is changed to 8140, or if it remains on 8150.
  - Fixed bug in which 'simp config' failed to find the template
    SIMP server host YAML file, puppet.your.domain.yaml, from
    /usr/share simp/environments/simp.  This bug caused subsequent
    'simp config' runs to fail, when the SIMP server hostname had
    changed from the hostname used in the first 'simp config' run.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 5.0.0
changelog:
  - 'simp' change:
    - Standardized help mechanism to be -h at all levels
      (main, command, subcommand)
    - Added descriptions to top level help command list
  - Added 'rsync' and 'git' to the RPM requires list.
  - 'simp' change:
    - Fixed bug in which the wrong Facter environment variable was set
  - 'simp config' changes:
    - Created a placeholder for where the OmniEnvController from the
      future 'simp environment' command would be used to set up the
      initial SIMP puppet and secondary environments.
    - Mock use of 'simp environment' code to set up the initial SIMP
      puppet and secondary environments.
    - Now require the user to use a new command line option,
      '--force-config', when the user wants to re-configure
      an existing SIMP puppet environment
    - Changed default environment from 'simp' (with corresponding
      'production' link) to 'production'
    - Restricted non-root user to only be able to run in '--dry-run'
      mode.  This was all that the user could actually do, but,
      without enforcement, lead to unexpected failures.
    - Fixed a bug in which the check for Puppet Enterprise was
      incorrect.  This resulted in incorrect puppetserver ports.
    - Reworked questionnaire to allow the user to opt out
      of LDAP all together
    - Removed code that loaded the scenario YAML files
    - Defer most actions until after all information has been
      gathered, instead of running them immediately.
      - When queries are appropriate, ask the user if they want to
        apply the configuration.
      - Group the deferred actions logically, so that the sequence
        of actions makes sense to the user.
    - Improved introductory text and descriptions of a few items
      that have been confusing for users
    - Removed the ability for a non-root user to set the Puppet
      digest algorithm.  This was a bug.
    - In cli::network::interface item, try to recommend an
      interface that has an IPv4 address set.  Also print out the
      list of available interfaces and their corresponding IPv4
      addresses (when set) in the description.
    - In cli::network::hostname item, when `hostname -A` returns
      more than one entry, iterate through all entries to try to
      find one that passes FQDN validation, instead of grabbing
      the first one.
    - Fail when the default, non-interactive value for a data item
      fails validation.
    - Added simp-cli version to the answers file as a YAML entry.
  - 'simp bootstrap' changes:
      No longer checks for the 'simp' Puppet and secondary environments (with
      their corresponding 'production' links) and fails if they do not exist.
      Instead, checks for the existence of SIMP Puppet and secondary 'production'
      environments and fails if both are not present.
    - Checks validity of manifests in the 'production' environment,
      not 'simp' environment, as the link that made them
      equivalent is OBE.
    - Fixed a bug in which the check for Puppet Enterprise was
      incorrect.  This would result in Puppet FOSS-specific bootstrap
      operations being executed.
    - Added an additional puppet agent tagged run on the bootstrap port
    - Added more log messages to make bootstrap process more clear


author: Chris Tessmer <chris.tessmer@onyxpoint.com> - 5.0.0
changelog:
  - Added 'simp environment' command
  - Added `simp environment new` subcommand
  - Added `simp environment fix` subcommand
  - Added `simp puppetfile generate` command
    - `simp puppetfile` command
    - `simp puppetfile generate` sub-command
  - Fixed various annoyances that prevented local smoke tests with `bin/simp`
    - Avoid using AIO Puppet with `USE_AIO_PUPPET=no`
    - Load all `simp` commands without `simp config` failing in non-puppetserver
      environments (`simp config` still fails as expected)
  - Moved logger to `Simp::Cli::Logging`
  - Fixed gem dependency-related warning when `simp` is run on real OSes
    - Updated dependency constraints in gemspec
    - Removed unnecessary ENV wrapper from gemspec
    - Documented changes in README.md


author: Michael Morrone <michael.morrone@onyxpoint.com> - 5.0.1
changelog:
  - Fixed a bug in which the tftpboot images copied into the rsync space in
    SIMP's secondary environment were not world readable.  This prevented
    clients from PXE booting.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 5.0.2
changelog:
  - Flesh out incomplete instructions on how to prevent possible root
    lockout from the SIMP server.
  - Fixed a typo in `simp environment new` built-in help.
  - Fixed errata in `simp environment fix` built-in help.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 5.2.0-0
changelog:
  - Release of 5.2.0-0
    - Numerous bug fixes and enhancements, see the Changelog
    - This *is* a breaking change, but centered around non-core modules,
      particularly NFS


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.0.0-RC1
changelog:
  - Added the dist flag to the release due to distribution specific logic
  - This is required due to automatic distribution-specific requirements that end
    up bound to the simp RPM


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.0.0-1
changelog:
  - Update to support augeasproviders_grub 3
  - augeasproviders_grub dropped support for some older OS and Ruby versions but
    did not have any Puppet logic breaking changes


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 5.1.0-0
changelog:
  - Upgraded to Hiera 3 from Puppet Labs
  - Incorporated a migration script for updating from the old simp-hiera
  - Replaced facter calls to 'lsb*' with 'operatingsystem*' in the 'post' section
    of the RPM


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 5.1.0-1
changelog:
  - Included missing documentation updates
  - Fixed the simp-bootstrap version update which missed the common -> simplib
    transition.


author: Nick Markowski <nmarkowski@keywcorp.com> - 6.0.2-0
changelog:
  - Removed core module binford2k-node_encrypt.  There are issues with
    the module and we don't currently use it anywhere in core.


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 6.1.0-0
changelog:
  - update puppetserver to 2.8.0-1
  - updated packages.yaml to pull puppet 4.10.6 rpms.
  - change diskdetect.sh kickstart file to use ext4 instead of xfs
  - add simp_snmp, simp_nfs and update augeasproviders_grub


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.1.0-0
changelog:
  - Removed pupmod-herculesteam-augeasproviders_base as a SIMP dependency
  - Removed the 'dist' from the /etc/simp/simp.version file


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.2.0-0
changelog:
  - Obsolete pupmod-electrical-file_concat in simp-extras package
  - Obsolete pupmod-simp-activemq and pupmod-simp-mcollective in
    simp package
  - Update versions of numerous dependencies of both simp and simp-extras
    packages.*
  - Move pupmod-puppet-yum from simp-extras package to simp packages, as
    required by pupmod-simp-tpm


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.2.0-0
changelog:
  - Update final dependencies for 6.2.0
  - Fix paths to configuration files
  - Remove the pupmod-puppetlabs-java_ks dependency from the simp package
  - Add of the following dependencies to the simp package:
    - pupmod-simp-systemd dependency
    - pupmod-puppetlabs-mount_providers
  - Remove the following dependencies from the simp-extras package:
    - pupmod-simp-jenkins
    - pupmod-simp-mcafee
  - Add the following dependencies to the simp-extras package:
    - pupmod-puppetlabs-docker
    - pupmod-puppetlabs-translate
    - pupmod-simp-dconf
    - pupmod-simp-dirtycow
    - pupmod-simp-simp_docker
    - pupmod-simp-simp_ipa
  - Update the pupmod-simp-simplib version due to a bug that potentially
    permanently breaks the puppetserver configuration


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.3.0-0
changelog:
  - Add the following dependencies to the simp package
    - pupmod-simp-deferred_resources
    - pupmod-simp-ima
    - pupmod-simp-simp_banners
    - pupmod-simp-tlog
    - pupmod-simp-tpm2
    - pupmod-simp-vox_selinux
  - Add the following dependencies to the simp-extras package
    - pupmod-simp-mate
    - pupmod-simp-simp_pki_service
    - pupmod-simp-x2go
  - Removed the following dependencies from the simp-extras
    package, as they have not yet been updated to Puppet 5
    - pupmod-elastic-elasticsearch
    - pupmod-elastic-logstash
    - pupmod-simp-simp_elasticsearch
    - pupmod-simp-simp_logstash


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.3.0-0
changelog:
  - Updated package versions for the latest release
  - Moved the following to simp-extras
    - pupmod-richardc-datacat
    - pupmod-simp-autofs
    - pupmod-simp-krb5
    - pupmod-simp-ima
    - pupmod-simp-network
    - pupmod-simp-nfs
    - pupmod-simp-tpm
    - pupmod-simp-tpm2


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.3.2-0
changelog:
  - Updated the following packages to address bug fixes. See the Changelog for
    relevant information.
    - pupmod-simp-incron
    - pupmod-simp-pupmod
    - pupmod-simp-simplib
    - pupmod-simp-sssd
    - pupmod-simp-stunnel


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.3.3-0
changelog:
  - Updated the following packages to address bug fixes. See the Changelog in
    the SIMP documentation (simp-doc package) for relevant information.
    - pupmod-simp-sssd


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.3.0-0
changelog:
  - Add the following dependencies to the simp package
    - pupmod-simp-deferred_resources
    - pupmod-simp-ima
    - pupmod-simp-simp_banners
    - pupmod-simp-tlog
    - pupmod-simp-tpm2
    - pupmod-simp-vox_selinux
  - Add the following dependencies to the simp-extras package
    - pupmod-simp-mate
    - pupmod-simp-simp_pki_service
    - pupmod-simp-x2go


author: Joseph Sharkey <shark.bruhaha@gmail.com> - 6.4.0-0
changelog:
  - Replaced pupmod-simp-systemd with pupmod-camptocamp-systemd.
    Ownership of this project has reverted to the Camptocamp org.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.4.0-0
changelog:
  - Added pupmod-puppet-posix_acl to the simp-extras package
  - Removed the following from the simp package
    - pupmod-simp-simpcat:  The module has been deprecated and all uses of
      it within SIMP modules have been replaced with concat.
    - pupmod-simp-site: Delivery of this module skeleton is longer relevant
      with the move to local Git repositories for SIMP-packaged puppet
      modules.
    - Obsolete pupmod-simp-site so that it is no longer installed and is removed
      on upgrade to 6.4.0


author: Jim Anderson <thesemicolons@protonmail.com> - 6.4.0-0
changelog:
  - Added message if 'simp_opt == prompt' where the user is directed to the
    documentation for partition requirements and prompted to remember to create a
    /boot partition.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.4.0-0
changelog:
  - Added the following to the simp-extras package
    - pupmod-simp-oath
    - pupmod-simp-simp_grub
    - pupmod-simp-simp_bolt
  - Updated package versions
  - Moved pupmod-puppetlabs-java from simp to simp-extras, as it is not
    required by any other packages in the simp package
  - Replaced pupmod-cristifalcas-journald with pupmod-simp-journald.
    The SIMP org has assumed ownership of this project.
  - Replaced pupmod-razorsedge-snmp with pupmod-puppet-snmp.
    The Vox Pupuli org has assumed ownership of this project.
  - Replaced pupmod-simp-timezone with pupmod-saz-timezone.
  - Replaced pupmod-vshn-gitlab with pupmod-puppet-gitlab.
    The Vox Pupuli org has assumed ownership of this project.
  - Added the following to simp
    - pupmod-simp-rkhunter
  - Added the following to simp-extras
    - pupmod-puppetlabs-ruby_task_helper
    - pupmod-simp-freeradius
    - pupmod-simp-hirs_provisioner
  - Removed the following from simp-extras because the
    versions supported are EOL
    - pupmod-elastic-elasticsearch
    - pupmod-elastic-logstash
    - pupmod-simp-simp_elasticsearch
    - pupmod-simp-simp_logstash
    - pupmod-richardc-datacat
    - pupmod-puppet-grafana
    - pupmod-simp-simp_grafana
  - Removed OBE pupmod-simp-dirtycow from simp-extras


author: Liz Nemsick <lnemsick.simp@gmail.com> - 0.0.3-0
changelog:
  - Fix 'puppet resource service' bugs in %post
  - Add /var/run/puppetlabs to the list of directories to traverse,
    when fixing puppet uid/gid.
  - Fix simp_rpm_helper bugs that prevented SIMP module RPM uninstalls
    in certain scenarios


author: Trevor Vaughan <tvaughan@onyxpont.com> - 0.0.3-0
changelog:
  - Handle PE and Puppet Open source in the post section
  - Add dist to the release field to account for RPM generation on EL6 vs EL7
  - Updates to work better with PE and with the new method for detecting
    kickstart installs as added by Chris Tessmer <ctessmer@onyxpoint.com>


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.0.6-0
changelog:
  - Updated the minimum version of the puppet-agent dependency to at least
    1.10.4 (packages puppet 4.10.4), due to 'puppet generate types' bugs
    in puppet-agent releases prior to that. These bugs cause the composite
    namevar fixes to not function properly.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 0.1.0-0
changelog:
  - Removed delivery of global, Hiera 3 hiera.yaml file.
  - Added logic to ensure any existing hiera.yaml.simp file is not removed
    on upgrade from simp-adapter <= 0.0.6.
  - Added uninstall logic to remove an existing hiera.yaml.simp file that had
    been preserved from simp-adapter <= 0.0.6, but which is no longer in the
    simp-adapter RPM file list.
  - Removed enabling OBE puppet trusted_node_data setting in %post
  - Removed disabling OBE puppet stringify_facts setting in %post


author: Liz Nemsick <lnemsick.simp@gmail.com> - 0.1.1-0
changelog:
  - Affect a copy with simp_rpm_helper when called in either the %posttrans
    or %post of a SIMP RPM.
  - Fix bug in simp-adapter.spec in which a comment line was missing the '#'


author: Liz Nemsick <lnemsick.simp@gmail.com> - 1.0.0
changelog:
  - Reworked simp_rpm_helper to install a module's content into a
    SIMP-managed, bare Git repository, instead of a 'simp' environment
    (/var/puppetlabs/code/environments/simp), during a module RPM
    install/upgrade.  See the comment block header in
    /usr/local/sbin/simp_rpm_helper for more detailed information about
    the new behavior and configuration.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 1.0.1
changelog:
  - Adjust simp_rpm_helper behavior to allows the simp-environment
    package to be upgraded to the simp-environment-skeleton package
    without simp_rpm_helper errors:
    - Accept a deprecated '--preserve' option in simp_rpm_helper.  This
      option no longer does anything.
    - Disable verification that '--target_dir' is a fully-qualified path.
  - Remove OBE %post logic plus the RPM requires and distribution
    release qualifier related to it.
  - Combine simp-adapter-foss and simp-adapter-pe into 1 package


author: Nick Markowski <nmarkowski@keywcorp.com>
changelog:
  - Updated the getting started guide to clarify what to check
    out to get an expected build of SIMP.


author: Trevor Vaughan <tvaughan@onyxpoint.com>
changelog:
  - Updated the RPM spec file to use the new SCL repos
  - You *must* have an appropriately configured Mock configuration for this to
    work!


author: Trevor Vaughan <tvaughan@onyxpoint.com>
changelog:
  - Ignored additional links in linkcheck that it did not handle properly
  - Rotated the order of the build so that 'master' properly defaults


author: Trevor Vaughan <tvaughan@onyxpoint.com>
changelog:
  - Updated the NFS HOWTO
  - Updated the Glossary
  - Updated the Redundant LDAP HOWTO
  - Updated the SFTP Restricted Accounts HOWTO
  - Updated the IPTables NAT HOWTO
  - Updated Rsyslog HOWTO for new module layout
  - Updated Glossary
  - Updated the HOWTO for Changing Puppet Masters
  - Updated Kerberos HOWTO


author: Nick Miller <nick.miller@onyxpoint.com>
changelog:
  - Added advice on how to recover from a failed boot due to selinux policy
  - Added tboot docs into the tpm HOWTO


author: Trevor Vaughan <tvaughan@onyxpoint.com>
changelog:
  - Added information on performing system scans as well as a SSG response
    template to the Security CONOP


author: Nick Miller <nick.miller@onyxpoint.com>
changelog:
  - Added justification for V-71849 results, when SIMP changes vendored
    permissions on RPM provided files


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com>
changelog:
  - Updated PXE boot instructions for UEFI.
  - Added section for 6.1.0 -> 6.2.0 upgrade for files that need to be updated.
  - Changed For Impatient to Quick Start


author: Michael Morrone <michael.morrone@onyxpoint.com>
changelog:
  - Updated System minimum requirements
  - Changed prompts for root commands in User Guide to #
  - Added implementation details to Managing Local/Service Users
  - Removed Indices and tables from index pages


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com>
changelog:
  - Remove obsolete 'HOWTO Configure a Puppet Master behind a NAT'
    and 'HOWTO Configure iptables NAT Rules'


author: Trevor Vaughan <tvaughan@onyxpoint.com>
changelog:
  - Added information regarding the removal of ELG packages from the ISO
  - Moved changelogs from `simp-core` into the project
  - Removed code to fetch changelogs from other repositories


author: Trevor Vaughan <tvaughan@onyxpoint.com>
changelog:
  - Added a warning about copy/pasting from the docs and quotes
  - Added a note to the 6.2->6.3 upgrade guide to restart the puppetdb process


author: Trevor Vaughan <tvaughan@onyxpoint.com>
changelog:
  - Updated tftpboot documentation to reference the Disk Encryption capability in
    the kickstart files.


author: Jim Anderson <thesemicolons@protonmail.com>
changelog:
  - Added a page under Installation Advanced Topics regarding disk
    partitioning.
  - Modified Transmission Confidentiality and Integrity to update location
    for location of certificates.
  - Added official hardware requirement of  3.4 GB of RAM + swap.
  - Managing Local/Service Users had an incomplete path for
    local_account.pp and service_account.pp.
  - Fixed typo in Prepare SIMP ldifs.
    - sed command had escaped asterisk, should be unescaped.


author: Trevor Vaughan <tvaughan@onyxpoint.com>
changelog:
  - Removed all calls to the 'site' module specifically
  - Rebranded references to the 'site' module as a convenient place holder and
    added appropriate glossary terms.
  - Added glossary terms for:
    - Puppet Module
    - Puppet Namespace
    - Site Profile


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 5.3.0-0
changelog:
  - Moved to semantic versioning
  - Added support for a 'site_files' module path in the primary 'simp'
    environment for modules like krb5 and pki that have files in them that should
    not be managed by r10k or code manager.


author: Nick Miller <nick.miller@onyxpoint.com> - 5.3.1-0
changelog:
  - Added keytab storage to site_files
  - Corrected site_files implementation to work with our krb5 implementation


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 5.3.1-0
changelog:
  - Relocated the 'site_files' directory and created a custom selinux policy for
    the included files.


author: Nick Markowski <nmarkowski@keywcorp.com> - 6.0.0-Alpha
changelog:
  - Updated nist compliance map to reference new gnome::enable_screensaver
    parameter.
  - Updated compliance maps to API 1.0.0 format
  - Updated hieradata to reflect changes in puppetdb (SIMP-1450)


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.0.0-Alpha
changelog:
  - Eliminated the 'localusers' capability
  - Changed the name to simp-environment
  - Ripped out all of the legacy materials
  - Updated to use the simp-adapter RPM helper


author: Nick Miller <nick.miller@onyxpoint.com> - 6.0.0
changelog:
  - Moved the default location of keydist from the normal puppet environment and
    modulepath to /var/simp/environments/simp/site_files/pki_files/files/keydist,
    which won't be overwritten or deleted when using r10k and a control repo
  - Added the SIMP scenarios feature, so a user can specify a class list and
    simp_options defaults they would like to use in their implementation
  - Stengthen default Puppet server hiera file to include most of the simp
    scenario and default simp_options values


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.0.1
changelog:
  - Moved the class lists from 'scenarios' Hiera data to pupmod-simp-simp
  - Updated site.pp to use include the base classes in the correct order


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.0.2
changelog:
  - Only warn about missing /var/www/yum/SIMP directory when this RPM is
    installed via the SIMP ISO.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.1.0
changelog:
  - Remove the unnecessary class includes from the EL6-specific hieradata
  - The appropriate class includes have been moved into the 'simp' and
    'simp-lite' scenarios in the simp module


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.1.0
changelog:
  - Remove YUM-related parameters in puppet.your.domain.yaml,
    as these parameters are managed by 'simp config'.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.2.0
changelog:
  - Move FakeCA down into /var/simp/environment/simp where it can be
    appropriately applied without getting wiped out by r10k or Code Manager
  - Make FakeCA use relative paths for writing keys
  - Ensure that a copy of the FakeCA core exists in /usr/share/simp so that users
    have a clean copy to work from


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.2.4-0
changelog:
  - Fix changelog/version mismatch which resulted in the release of
    a 6.2.1 tag for which the RPM version was erroneously 6.2.3.


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 6.2.5-0
changelog:
  - selinux policy in module simp-environment was changing settings on rsync files not in the
    simp environment and removing their selinux context.  This caused DNS, DHCP to fail
    if they were running in an enviroment by a name other then simp.
  - moved selinux policy to simp-environment module and had simp rsync require this module
    so the selinux policy for /var/simp directory would be in one spot.
    file contexts are not overwritten by it.
  - updated the policy so it would explicitly set the context for files in simp environment and
    not overwrite settings that were not explicitly set.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.2.6-0
changelog:
  - Ensure that FakeCA works properly with Puppet Enterprise
  - Ensure that the RPM installation permissions work properly with Puppet
    Enterprise


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.2.7-0
changelog:
  - Enable the UDP localhost rsyslog server on the puppetserver to capture
    messages from the puppet services for processing and forwarding


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.2.8-0
changelog:
  - Pre-populate the /var/simp/environments/simp/site_files/pki_files/
    directory tree and set its ownership and permissions appropriately.
    This is part of the fix to the failure of SIMP to bootstrap on
    a system on which root's umask has already been restricted to 077.


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 6.2.10-0
changelog:
  - Added force option to the selinux fixfiles command in the post install
    section.  If this is not set, only the type context is restored, even
    though the user context is also set in the selinux policy.
  - Removed logic to link production environment to simp environment.  This
    is done in 'simp config', if it is needed.
  - Updated rsync version required to 6.2.  Selinux code was moved from
    simp-rsync to simp-environment at that time and using older versions can
    cause unexpected results in the selinux policy.


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 6.2.5-0
changelog:
  - selinux policy in module simp-environment was changing settings on rsync files not in the
    simp environment and removing their selinux context.  This caused DNS, DHCP to fail 
    if they were running in an enviroment by a name other then simp.
  - moved selinux policy to simp-environment module and had simp rsync require this module
    so the selinux policy for /var/simp directory would be in one spot.
    file contexts are not overwritten by it.
  - updated the policy so it would explicitly set the context for files in simp environment and
    not overwrite settings that were not explicitly set.


author: Nick Miller <nick.miller@onyxpoint.com> - 6.3.0-0
changelog:
  - Added a default Hiera 5 hiera.yaml.
  - Renamed environments/simp/hieradata/ to environments/simp/data/ to support
    staged rollout of environment-specific hiera.yaml use.
  - Removed the OBE environments/simp/hieradata/compliance_profiles directory
    and references to it.
  - Removed unnecessary package dependencies to make installation more portable.
  - Only use simp_rpm_helper to copy files installed in /usr/share/simp/environments
    into /etc/puppetlabs/code/environments/simp, as appropriate, if this is an
    initial install.
  - Only use simp_rpm_helper to remove file copies that reside in
    /etc/puppetlabs/code/environments/simp, as appropriate, if this is an erase.


author: Michael Riddle <michael.riddle@onyxpoint.com> - 6.3.1-0
changelog:
  - If the gencerts scripts are called via sudo, puppet won't be in the path.
    Added the fully qualified path to the puppet binary to remedy this issue.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.3.1-0
changelog:
  - `simp_options::ldap` now defaults to `false` in the simp and simp_lite
    scenarios, because use of LDAP is not required.  This change
    is important for sites that do not use LDAP at all or use a different
    implementation of LDAP that does not match the schemas provided by
    SIMP.


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 7.0.0-0
changelog:
  - Reworked packaging so this RPM no longer modifies files used by a user's
    'simp' Puppet environment
    - Changed installation directory from /var file to /usr/share/simp/environment-skeleton for the
      subset of file previously installed there.  All files are
      now installed in /usr/share/simp as an example, only.
    - Removed OBE %config(noreplace) directives on files previously installed
      in /var/simp/environments/simp.
    - Removed erroneous %config(noreplace) directives on files installed
      in /usr/share/simp/environments/simp.
    - Removed actions that will be implemented by a simp cli command
      - selinux fixfiles on the /var/simp directory during installation.
      - cacertkey creation from post install.
      - Calls to the RPM helper script in the %post and %postun sections.
        This means the default environment is no longer copied into
        /etc/puppetlabs/code/environments/simp upon initial install, and no longer
        removed from that directory upon erase.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 7.1.0-0
changelog:
  - Rename the package to 'simp-environment-skeleton' to more accurately portray
    its purpose.
  - Remove all SELinux components and add a dependency on 'simp-selinux-policy'
  - Rename `simp` environment directory to `puppet`
  - Rename template `environment.conf` `environment.conf.template` and
    within that file, rename the `simp` environment string to
    %SKELETON_ENVIRONMENT%.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.4.0-0
changelog:
  - Updated package versions
  - Moved pupmod-puppetlabs-java from simp to simp-extras, as it is not
    required by any other packages in the simp package
  - Replaced pupmod-cristifalcas-journald with pupmod-simp-journald.
    The SIMP org has assumed ownership of this project.
  - Replaced pupmod-razorsedge-snmp with pupmod-puppet-snmp.
    The Vox Pupuli org has assumed ownership of this project.
  - Replaced pupmod-simp-timezone with pupmod-saz-timezone.
  - Replaced pupmod-vshn-gitlab with pupmod-puppet-gitlab.
    The Vox Pupuli org has assumed ownership of this project.
  - Added the following to simp
    - pupmod-simp-rkhunter
  - Added the following to simp-extras
    - pupmod-puppetlabs-ruby_task_helper
    - pupmod-simp-freeradius
    - pupmod-simp-hirs_provisioner
  - Removed the following from simp-extras because the
    versions supported are EOL
    - pupmod-elastic-elasticsearch
    - pupmod-elastic-logstash
    - pupmod-simp-simp_elasticsearch
    - pupmod-simp-simp_logstash
    - pupmod-richardc-datacat
    - pupmod-puppet-grafana
    - pupmod-simp-simp_grafana
  - Removed OBE pupmod-simp-dirtycow from simp-extras


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.4.0-0
changelog:
  - Added the following to the simp-extras package
    - pupmod-simp-oath
    - pupmod-simp-simp_grub
    - pupmod-simp-simp_bolt


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 2.0.0-2
changelog:
  - Now install the GPG keys to /usr/share/simp/GPGKEYS and /etc/pki/rpm-gpg
  - Copy the keys into the SIMP default web dirs if they exist and be sure to
    clean up after ourselves in the future.


author: Nick Miller <nick.miller@onyxpoint.com> - 3.0.0-0
changelog:
  - Added new puppet gpg key from http://yum.puppetlabs.com/RPM-GPG-KEY-puppet
  - Ensure facter is in $PATH during post install


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 3.0.0-1
changelog:
  - Only copy in the SIMP and Puppet GPG keys into the system trust chain.
    Copying more than that is too presumptive.
  - Removed the 'dist' qualifier from the version since it was determined that
    the public GPG keys are OK to be common across all releases.


author: Nick Miller <nick.miller@onyxpoint.com> - 3.0.2-0
changelog:
  - simp-gpgkeys is now its own module
  - Added a yaml file with a download source and a fingerprint to check cert integrity
    - And a travis file to check them


author: Liz Nemsick <lnemsick.simp@gmail.com> - 3.0.3-0
changelog:
  - Fix changelog/version mismatch which resulted in the release of
    a 3.0.2 tag for which the RPM version was actually 3.0.3.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 5.0.0-1
changelog:
  - Updated to allow for the splitting of the rsync space by facts. OS
    and major version by default.
  - Also updated to use /var/simp instead of /srv for the defaults.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 5.0.0-4
changelog:
  - Removed all jenkins plugins since we were not properly maintaining them.
  - Updated all TFTPBoot material to support RHEL7.1 and CentOS/RHEL6.6.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 5.1.0-0
changelog:
  - Removed everything that *may* fall under a conflicting license. We will need
    to evaluate how to handle package building going forward.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 5.1.0-1
changelog:
  - Added a ClamAV specific RPM to handle the different license in ClamAV.
  - These should eventually be split.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.0.1-0
changelog:
  - Updated the README that is delivered with the SIMP rsync environments to talk
    a bit about the shares structure and to encourage users to read the HOWTO


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 6.2.0-0
changelog:
  - The selinux policy in simp-environment was changing settings on rsync
    files not in the simp environment.  If DNS and DHCP were running in an
    environment other then simp, relabeling the filesystem would change the
    selinux context to default context for /var/simp. This, in turn, caused
    these services to fail if selinux was in enforcing mode.
  - The selinux policy and the logic to set it up were moved to simp-environment module
    so the selinux policy for /var/simp directory would be in one spot.
  - Simp-rsync now requires the simp-environment


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.2.1-0
changelog:
  - Added logic in dhcpd.conf to select the appropriate PXEboot file
    based on the boot type (BIOS or UEFI).


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 6.2.1-1
changelog:
  - Remove dependency on simp-environment, which will be removed in
    SIMP 6.4 and renamed to simp-environment-skeleton
  - Add dependency for simp-environment-selinux-policy
    to make sure selinux policy for /var/simp directory is not
    removed.
  - This module is not needed for new installs after 6.4 and is replaced
    by simp-rsync-skeleton.  This module should not
    be removed in existing systems if there is a `simp` environment because
    it will remove the files under /var/simp/environments/simp/rsync.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.2.1-2
changelog:
  - Changed Require for simp-environment-selinux-policy to one
    for simp-selinux-policy, as that package has been renamed.


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 7.0.0-0
changelog:
  - Renamed to simp-rsync-skeleton. The last release of simp-rsync provides a
    stub for not removing files that are currently in place upon system upgrade.
  - Updated Rsync to install under the skeleton directory instead
    of in the active environment directories.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 7.0.1-0
changelog:
  - Removed OBE *.rpmnew deletion logic in %post
  - Removed OBE OS symlink login in %post and %preun
  - Removed OBE %pre logic


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 1.0.0-0
changelog:
  - Creation of a new simp-selinux-policy package.  Policies were
    originally packaged in the simp-environment package.


author: XXX <x.x@x.x> - 477.0.0-0
changelog:
  - An update to TPM 2.0 draft specification revision 124
  - A command line parameter to force remanufacturing. The previous release
    performed manufacturing each time the simulator was started. All NV memory
    was initialized. By default, without the new command line parameter, this
    build retains NV state.


author: XXX <x.x@x.x> - 832.0.0-0
changelog:
  - The TPM state NVChip is not compatible with previous builds.
    - Remove NVChip before running the first time.
  - An update to TPM specification revision 138.
    - 138 includes 4 new commands and a refactoring of the crypto code to make it
      easier to replace the crypto library.


author: XXX <x.x@x.x> - 1119.0.0-0
changelog:
  - Support for OpenSSL 1.1.x.
  - Support for big endian platforms, using BIG_ENDIAN_TPM=YES
  - An update to TPM specification draft revision 146
    - avalable for public review
    - includes changes to TPM2_CreateLoaded and TPM2_EncryptDecrypt
  - Support for Nuvoton TPM vendor specific commands
  - A contributed makefile.mac for Mac
  - The TPM starts powered up, so the initial power up command is not necessary
  - Non-deterministic random numbers are used when SIMULATION is not set
  - A few tweaks for better cygwin support


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 5.0.0-4
changelog:
  - Updated puppetlast to properly handle expired entries and unknown
    nodes.
  - Unfortunate, since in Puppet 4.0, the server API is going away :-(.


author: Kendall Moore <kmoore@keywcorp.com> - 5.0.0-4
changelog:
  - Updated simp config to ask user if they want to encrypt logs.
  - Updated simp config to re-word the DHCP prompt to be more clear.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 5.0.0-5
changelog:
  - Updated the simp 'config' and 'bootstrap' commands to properly ahndle the new
    Puppet server and environments.
  - Removed the requirement on puppet-server
  - Added script 'upgrade_to_puppetserver' to assist in upgrading from a
    pre-puppetserver system to the new Clojure-based puppet server.
  - Added script 'migrate_to_environments' to assist in migrating a legacy system
    to an environment-based one.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 5.0.0-8
changelog:
  - Added a 'hiera_upgrade' script that moves away from the SIMP patched one to
    the use of the 'alias' function.


author: Nick Miller <nick.miller@onyxpoint.com> - 6.0.0-0
changelog:
  - puppetlast:
    - Now uses the new PuppetDB nodes endpoint over http
    - Gathers new information about the nodes, which can be now be sorted and
      isolated by status and environment
    - Expired nodes will no longer show up in the query
    - Errors and exit scenarios will now be handled more gracefully
    - Removed man page in favor of `puppetlast -h`


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 6.0.2-0
changelog:
  - added example ldifs to be copied to /usr/share/simp
  - changed rake and gemfiles so pkg:rpm would work


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.0.4-0
changelog:
  - Fixed an incorrect dependency on /bin/ruby as opposed to /usr/bin/ruby
  - Changed all instances of #!/usr/bin/env ruby to #!/usr/bin/ruby per the
    Fedora packaging guidelines


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.1.0-0
changelog:
  - Added script to upgrade SIMP 6.0.0 to SIMP 6.1.0
  - Removed obsolete scripts
    - hiera_config
    - hiera_upgrade
    - migrate_to_simplib


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.1.2-0
changelog:
  - Fixed bug in which updaterepos would fail when executed with Ruby 1.8.x
    (e.g on CentOS 6 servers)
  - Fixed bug in which gen-ldap-update generated malformed ldif
    output when executed with Ruby 2.x (e.g on CentOS 7 servers)


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.2.2-0
changelog:
  - Update the path of SIMP's Puppet skeleton to
    /usr/share/simp/environment-skeleton/puppet. This is the correct
    path for simp-environment-skeleton >= 7.1.0.


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 6.2.2-0
changelog:
  - Update updaterepo script to change permissions on the repo
     files as well as repodata.
  - Update unpack_dvd script
    - Make sure permissions on all directories containing RPMs for the
      repo are correct.
    - Only attempt to change ownership of files if run as root.
    - Put `noarch` rpms under the `noarch` directory for the SIMP repo.
    - Allow the user to specify the version directory for the OS, because
      the CentOS `.treeinfo` file only contains the major OS version number.
    - Added an option to allow user to not link the extracted files to the
      major version.
    - Added an option to change what group is used to own the files.
    - Used puppet ruby instead of system ruby and removed Ruby 1.9 logic
      and changed puppet-agent dependency to > 5.0
  - Updated the README


author: Nick Miller <nick.miller@onyxpoint.com> - 2.6.2
changelog:
  - Update rpm to include r10k 2.6.2 and other components.
  - Gems are now built from source and not contained in the repo.
    See build/sources.yaml.
  - Added a basic docker test: rake test


author: Liz Nemsick <lnemsick.simp@gmail.com> - 2.6.2-1
changelog:
  - Fixed bug in RPM variable used in simp-vendored-r10k description
  - Fixed bug in which release for r01k gem in sources.yaml was not being
    used for the RPM release number of simp-vendored-r10k and
    simp-vendored-r10k-doc packages.


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 3.1.1-0
changelog:
  - Updated source versions to use r10k 3.1.1 and updated
    dependency gems where possible.  Latest puppet_forge
    gem relies on faraday ~> 0.9.0 so that gem
    cannot be updated until next release of puppet_forge gem.
  - Remove puppet 4 support.
  - Updated the version of simp-rake-helpers in Gemfile
    because earlier version has r10k dependency set to ~> 2.2.
  - Updated release for all dependencies so they would all be reinstalled
    in the new simp-r10k directory.  Gem dependencies were being installed 
    in r10k-<version> directory.  If r10k was
    updated it create a new r10k-<version> directory but if dependencies had
    not been updated they were not reinstalled in new directory. To fix this
    the version number was removed off the gem sub-directory. The release
    versions had to be updated this one time to force reinstall in the new
    versionless directory.
  - Add fixtures file so FIPS tests will pass.
  - updated Gemfile for simp-beaker-helpers to include new functions used in
    testing


author: Morgan Haskel <morgan.haskel@onyxpoint.com> - 1.0.2-0
changelog:
  - Updated with all sorts of goodness including:
    - Some code cleanup
    - The ability to dump to syslog
    - The ability to replay from syslog
    - A rate limiter to not collect things that don't seem to be
      originating from a human.


author: John Jackson <jjackson@prophasys.com> - 1.0.2-1
changelog:
  - Determined that the sudosh.sh overlay in /etc/profile.d did not
    properly pass arguments to sudosh when called with -c and whitespace
    separation. This has been fixed.


author: Trevor Vaughan <tvaughan@ponyxpoint.com> - 1.0.2-2
changelog:
  - Rewrote some of the code to work better with syslog.
  - Fixed some typos
  - Removed some unnecessary code
  - Updated the spec file to properly use the WITH_SYSLOG calls


author: Peter Jones <pjones@redhat.com> - 4.05-4
changelog:
  - Fix build problem from kernel-headers' removeal of ext2_fs.h
    (fix backported from as-yet-unreleased upstream version.)


author: Peter Jones <pjones@redhat.com> - 4.05-12
changelog:
  - Toolchain changes between when this originally got built and 4.05-9 means
    4.05-9 - 4.05-11 don't actually work.
    Related: rhbz#1085434


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 1-1
changelog:
  - Release v1. Not ready for production. Following features are included.
  - Recording of user input, program output and window size changes.
  - Support for writing into syslog and files.
  - Tlog-rec configuration through system-wide configuration file
    /etc/tlog/tlog-rec.conf, environment variables and command line.
  - Very basic playback directly from ElasticSearch.


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 2-1
changelog:
  - Release v2. Not ready for production. Following features are added.
  - Fully-fledged command-line interface to tlog-play, along with config file
    and man pages.
  - Support for playback from file in tlog-play.
  - Make tlog-play follow mode controllable and off by default.
  - Get tlog-rec shell also from TLOG_REC_SHELL environment variable.
  - Support non-TTY stdin/stdout in tlog-rec, allowing its use with
    non-interactive SSH sessions.
  - Support building on and packaging for EPEL5.


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3-1
changelog:
  - Release v3. Added features and implemented fixes follow.
  - Make each JSON message timing data start with window size.
    This makes it possible to pick up the stream from any message and also
    combine messages, with window size known and preserved at all times.
  - Add "term" field to JSON messages, specifying terminal type.
  - Add "ver" field to JSON messages, specifying message format version.
  - Set "SHELL" environment variable to actual user shell in tlog-rec.
  - Check for locale's charset and abort tlog-rec if it's anything but the only
    supported UTF-8.
  - Add -v/--version option support to tlog-rec and tlog-play.
  - Fix tlog-rec and tlog-play error output by accumulating error messages and
    outputting them only after terminal settings are restored, on exit. Output
    startup warnings before switching to raw terminal settings.
  - Output a newline after restoring terminal settings in tlog-rec and
    tlog-play, so that following output is not stuck to the end of the last line
    of the raw output.
  - Add an Elasticsearch mapping to documentation directory.
  - Disable input logging by default to avoid storing passwords. Please enable
    it explicitly in configuration, or on the command line, if necessary.
  - Close log file written by tlog-rec on executing the shell in the child to
    prevent log modification by the recorded user.
  - Support running tlog-rec SUID/SGID to prevent recorded users from killing or
    modifying it. Make tlog-rec SUID/SGID to user "tlog" in the RPM package.
  - Add session locking to tlog-rec. This prevents tlog-rec from recording if
    the audit session is already recorded by creating per-audit-session lock
    files in /var/run/tlog. This only makes sense with tlog-rec SUID/SGID.
    When certain failures occur while creating a lock file, session is assumed
    unlocked and is recorded anyway, as it is safer to record a session than
    not. Add corresponding setup to the RPM package.
  - Reproduce the recorded program (shell) exit status in tlog-rec similarly to
    how Bash reproduces the last executed command status.
  - Update and expand README.md to describe secure log message filtering with
    rsyslog, and playback directly from Elasticsearch, among other, smaller
    additions.


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 4-1
changelog:
  - Release v4. Added features and implemented fixes follow. See README.md and
    manpages for documentation of new features.
  - Extract user session recording functionality from tlog-rec into a new tool:
    tlog-rec-session. It should be used as the user's login shell now, and
    tlog-rec should be used as a general recording and testing tool.
  - Add (optional) support for writing to and reading from Systemd Journal - the
    "journal" reader and writer.
  - Make tlog-rec default to "file" writer, and tlog-rec-session to "journal",
    if built with Journal support, and to "syslog" otherwise.
  - Add "-o" option to tlog-rec as an alias to "--file-path".
  - Add "-i" option to tlog-play as an alias to "--file-path".
  - Assume locale charset is UTF-8, if ASCII charset is detected, since that is
    a likely indication the locale settings were lost. E.g. upon console login
    or "su -" on Fedora and RHEL.
  - Switch the "ver" JSON field type to string. Now it should be two numbers
    separated by a dot. The increase of the first number indicates
    forward-incompatible changes, the increase of the second number -
    forward-compatible. If the dot and the second number are omitted, the second
    number is considered to be zero. Bump the format version to "2".
  - Add a new JSON field: "rec", containing an opaque host-unique recording ID.
    Bump the format version to "2.1".
  - Add support for playback controls, both through the command line and via
    playback-time control keys, including: speed adjustment, pause/resume,
    fast-forward to a time, and packet-by-packet stepping through the recording.
  - Add optional rate-limiting of logged messages. Both throttling and dropping
    messages are supported.
  - Add "--lax" option to tlog-play to allow playing back recordings with
    missing messages.
  - Fix input being ignored when there is a lot of output, while recording.
  - Remove addition of tlog-rec (tlog-rec-session) to /etc/shells from RPM
    packaging to prevent users from changing their shells themselves once it has
    been assigned.
  - Add support for specifying the shell to start via the tlog-rec-session
    executable name. E.g. by making a tlog-rec-session-shell-zsh ->
    tlog-rec-session symlink and executing it. That can be used to specify
    particular shells to be recorded for specific users by assigning these
    symlinks as their login shells.
  - Make error messages from all the tools a bit less noisy and more readable.


author: Sun Yunying <yunying.sun@intel.com> - 1.1.0-2
changelog:
  - Removed BuildRequires for gcc
  - Move tpm2-abrmd systemd service to /usr/lib/systemd/system
  - Added scriptlet for tpm2-abrmd systemd service
  - Use autoreconf instead of bootstrap


author: Sun Yunying <yunying.sun@intel.com> - 1.1.0-4
changelog:
  - Rename and relocate udev rules file to _udevrulesdir
  - Update scriptlet to add service name after systemd_postrun


author: Sun Yunying <yunying.sun@intel.com> - 1.1.0-2
changelog:
  - Remove pkg_version to avoid dupliate use of version
  - Remove redundant BuildRequires for autoconf/automake/pkgconfig
  - Add comments for BuildRequires of sapi/tcti-device/tcti-socket
  - Use ExclusiveArch instead of ExcludeArch
  - Requires tpm2-tss version updated to 1.0-2
  - Updated release version and changelog


author: Sun Yunying <yunying.sun@intel.com> - 1.1.0-3
changelog:
  - Change spec file permission to 644 to avoid rpmlint complain
  - Update Requires to fix dependency check error reported in Bodhi
  - Remove tpm2-tss-devel version in BuildRequires comment
  - Update release version and changelog


author: Sun Yunying <yunying.sun@intel.com> - 1.1.0-4
changelog:
  - Dependency check failed for Requires again, here to fix this
  - Update release version and changelog


author: Jerry Snitselaar <jsnitsel@redhat.com> - 1.1.0-5
changelog:
  - Remove epel dependencies
  - Change tpm2-tss dependency to not be tied to 1 version
  - Fix resource leak in InitSysContext
  - Clean up HashEKPublicKey
  - Add needed null checks to tpm2_getmanufec
  - clean up resource leak in tpm2_getmanufec
  - use strdup to get server address in tpm2_getmanufec
  - change preparePcrSelections_g to void
  - return on success in print_rc_tpm_error_code
  - Update release version
  resolves: rhbz#1275029 - Add tpm2.0-tools package


author: Sun Yunying <yunying.sun@intel.com> - 1.0-2
changelog:
  - Remove global macro pkg_version to avoid duplicate of version
  - Use ExclusiveArch instead of ExcludeArch
  - Use less wildcard in %files section to be more specific
  - Add trailing slash at end of added directory in %file section
  - Remove autoconf/automake/pkgconfig(cmocka) from BuildRequires
  - Increase release version to 2


author: Jerry Snitselaar <jsnitsel@redhat.com> - 1.0-3
changelog:
  - Add systemd unit for resourcemgr
  - Add utils subpackage
  - Add Makefile.am patch to install test programs
  - Add patch to swap out AX_PTHREAD for different check
  - Increase release version to 3
  resolves: rhbz#1275027 - Add TPM 2.0 System API (SAPI) library


