# changelog

author: Dave Dykstra <dwd@fnal.gov> 1.1-1
changelog:
  - fix a couple of kerberos-related things: set missing $THISHOST in
      remove-repository, and set a PATH in pull_and_push to find kinit
      (since cron doesn't set the PATH).


author: Dave Dykstra <dwd@fnal.gov> 1.3-1
changelog:
  - also set a PATH in remove-repository and add-repository to find kinit,
      in case they are run from cron


author: Dave Dykstra <dwd@fnal.gov> 1.4-1
changelog:
  - have add-repository and pull_and_push edit the new $CVMFS_STRATUM1 URL
    put in server.conf by cvmfs-server 2.1.20, to point to the stage
    subdirectory
  - change pull_and_push to accept single repository name to update instead
    of all repositories
  - change add-repository to support keys directly in /etc/cvmfs/keys or
    in /etc/cvmfs/keys/<domain> directories
  - change add-repository to add optional $EXTRAKEYS to added repository
    if they're not already in the default


author: Dave Dykstra <dwd@fnal.gov> 1.6-1
changelog:
  - add a "continue" option to add-repository to do just the snapshot
    part, in case the initial snapshot fails


author: Dave Dykstra <dwd@fnal.gov> 1.7-1
changelog:
  - Always have the /var/spool/cvmfs/<repo>/tmp symlink point to $STORAGE
    so it's one less thing to do when moving a repo from one $SRV to another.


author: Dave Dykstra <dwd@fnal.gov> 2.0-1
changelog:
  - Remove Requires: heartbeat so package can also work without heartbeat
  - For convenience of non-heartbeat system, add a symlink pointing to
      /etc/ha.d/resource.d/cvmfs-push-abort
    at
      /usr/share/cvmfs-hastratum1/push-abort
  - Add /usr/bin/cvmfsha-is-master and cvmfsha-is-backup which return an
    exit code of 0 only on the master machine or backup machine
    respectively (it is possible to be neither).  If the hastratum1.conf
    configuration variable IS_HA_MASTER_CMD or IS_HA_BACKUP_CMD
    respectively are set, the command listed will be eval'ed to
    determine this; if the variables are not set, the corresponding
    heartbeat commands are used.
  - Add "cvmfsha-" prefix symlinks for each of the /usr/sbin tools
  - Add OSG support tools in /usr/share/cvmfs-hastratum1: print-osg-repos
    and generate-osg-replicas
  - Add general tool /usr/bin/watch-network-q for watching queued network
    requests


author: Dave Dykstra <dwd@fnal.gov> 2.2-1
changelog:
  - Change add-repository to allow a domain public key to be missing if
    $EXTRAKEYS is set.  This is to support repositories from any domain
    being signed by the OSG public key.
  - Add -h option to add-repository to add on only current half of ha pair
    of machines.  This is for use when re-installing a machine.
  - Change add-repository to ignore differences in file modification times
    of the data between the master and backup machines.
  - Change pull_and_push to not do push if remote side hasn't finished
    initial snapshot, because the initial snapshot can take a long time
    when re-installing a machine from scratch including the data.
  - Change pull_and_push ABORT to kill with -15 instead of -9, so that
    cvmfs_server can clean up any locks before exiting.


author: Dave Dykstra <dwd@fnal.gov> 2.3-1
changelog:
  - Allow pull_and_push to take over if both sides of a repository are
    made with add-repository -h.
  - Hide error message in pull_and_push ABORT command coming from second
    kill attempt if the first attempt succeeded.
  - Add support for cvmfs-server-2.2.X's info directory
  - Allow parallel pull_and_push commands, up to $MAXPARALLELPULL which
    defaults to 4.


author: Dave Dykstra <dwd@fnal.gov> 2.5-1
changelog:
  - Add -H option to add-repository that's just like -h except will only
    add if some old data is present.
  - Add -h option to remove-repository to remove only the current HA half
    and leave data behind.
  - Add -t option to generate_replicas to only generate a short list of
    test replicas rather than the whole list.


author: Dave Dykstra <dwd@fnal.gov> 2.6-1
changelog:
  - Change add-repository to always use cvmfs_server add-replica -z to enable
    garbage collection when it is available in the upstream repository.


author: Dave Dykstra <dwd@fnal.gov> 2.7-1
changelog:
  - Back out the change from 2.6-1 and instead add script cvmfsha-gc-all
    that runs garbage collection on all repositories that have garbage
    collection enabled on the stratum 0.  Call it from cron on both
    master and backup machines, and redirect output to a log file.


author: Dave Dykstra <dwd@fnal.gov> 2.8-1
changelog:
  - Remove .cvmfsreflog if it is present when adding repository back on
    existing data with add-repository -h.


author: Dave Dykstra <dwd@fnal.gov> 2.9-1
changelog:
  - Copy the reflog.chksum file to the backup machine in add-repository,
    when it is invoked without -h.


author: Dave Dykstra <dwd@fnal.gov> 2.12-1
changelog:
  - Add restore-replicas command for restoring the replica configurations
    on a freshly reinstalled backup machine.


author: Dave Dykstra <dwd@fnal.gov> 2.13-1
changelog:
  - Add '--continue-failed' option to manage-replicas
  - Add manage-replicas-log function for handling logging of parallel
    manage-replicas processes
  - Make restore-replicas a little more robust


author: Dave Dykstra <dwd@fnal.gov> 2.14-1
changelog:
  - Allow add-repository to reuse old data even when not using -h
  - Redirect most of restore-replicas output to a file


author: Dave Dykstra <dwd@fnal.gov> 2.15-1
changelog:
  - Fix off by one error in manage-replicas-log
  - Add manage-replicas -d option and use it in manage-replicas-log to
    pass in $STORAGE so the -c option can correctly know when an
    initial snapshot isn't completely finished
  - Change manage-replicas to accept 'repositories' (from a stratum0) in
    addition to 'replicas' from a replist


author: Dave Dykstra <dwd@fnal.gov> 2.16-1
changelog:
  - Make sure that /usr/sbin is in the PATH inside manage-replicas-log
    and restore-replicas. The former is typically run from cron and the
    latter from puppet, and those don't necessarily have /usr/sbin in
    the path.


author: Dave Dykstra <dwd@fnal.gov> 2.17-1
changelog:
  - Change add-repository to clean up the repository storage if
    add-replica fails.  This prevents a situation of confusion between
    good old data and bad new data.


author: Dave Dykstra <dwd@fnal.gov> 2.18-1
changelog:
  - Change add-repository to make an updating lock while doing the rsync,
    so manage-replicas won't try to start another add-repository during
    that time.


author: Dave Dykstra <dwd@fnal.gov> 2.19-1
changelog:
  - Use the -p option to add-replica in add-repository, to avoid creating
    the httpd configuration file.
  - When an addcmd fails, do not call remcmd if the --continue-failed option
    was given.


author: Dave Dykstra <dwd@fnal.gov> 2.20-1
changelog:
  - Change add-repository -H to also go ahead if an initial snapshot
    exists on the partner, to support the case of bootstrapping a
    completely wiped backup machine.  In that case, have it snapshot
    from the partner.
  - Remove generate_replicas


author: David Front <dfront@gmail.com> 6.0-11
changelog:
  - Kludge to artificially avoid huge awstats logs:
    At src/usr/share/awstats/squid_rotate_run_awstats.sh.proto:
    If /etc/awstats/customize.sh has a record like
       export RM_BEGIN_SIDER=1
    then remove all records of awstats files between BEGIN_SIDER and END_SIDER.


author: David Front <dfront@gmail.com> 6.0-12
changelog:
  - Remove the recent kludges to clean BEGIN_SIDER and to handle IP
  - Add test that password-file exists as prerequisite to install
  - Rotate of modifiedqueries.log moved from frontier-tomcat to frontier-awstats
    rpm, to avoid dependency between user of frontier-tomcat and frontier-squid
    rpms'
  - support default squid user being squid (if the file /etc/squid/squidconf is
    missing).


author: David Front <dfront@gmail.com> 6.0-13
changelog:
  - Supporting rpm verify, command:'rpm -V':
    -- Add the prefix '%verify(not user group)' to each %files entry, 
       in order to prevent complaints from 'rpm -V', like:
  	.....UG.    <fileName>
    -- Note, however, that 'rpm -V' may still create misleading complaints like:
  	missing   ... <fileName>.proto


author: David Front <dfront@gmail.com> 6.0-14
changelog:
  - Complete support of rpm verify, command:'rpm -V':
    Do not remove *.unproto files (after usage), in order to cause "rpm
    -V" to pass.


author: David Front <dfront@gmail.com> 6.0-15
changelog:
  - Apply fix at src/usr/share/awstats/squid_rotate_run_awstats.sh.proto
    by Dave Dykstra to support non aliased DNS names. 
  - Remove ${RPM_INSTALL_PREFIX}/usr/share/awstats/squid_rotate.sh 
    This script is installed by cms awstats tar, but is not used by the rpm.
  - Now, squid calls the awstats script, if it exists,
    to prevent related bugs and simplify the code.


author: David Front <dfront@gmail.com> 6.0-16
changelog:
  - At upgrade, remove no-more-needed directory/file/lines:
    -- logs dir: ${RPM_INSTALL_PREFIX}/var/log/fontier-awstats
    -- file: ${RPM_INSTALL_PREFIX}/usr/share/awstats/squid_rotate_run_awstats.sh
    -- awstats crontab entries
  - Rename /etc/awstats/squid_rotate_run_awstats.sh to /etc/awstats/run_awstats.sh
  - Simplify run_awstats.sh: No need to set LogFile at awstats configuration
    file, because this is over ridden by an argument to awstats.pl
  - Cause run_awstats.sh to be more robust:
    If configuration creation fails, exit, and do not overwrite previous
    configuration.


author: David Front <dfront@gmail.com> 6.0-17
changelog:
  - A small technical change at the spec file to support source rpms for
    frontier rpms 
  - Use symbolic link to unproto.sh to simplify source tar ball creation


author: Dave Dykstra <dwd@fnal.gov> 6.9-1.1
changelog:
  - Change release numbers to be based on the underlying awstats
    package release number from the internet.
  - Add chkthread data collection to be able to plot frontier
    servlet threads, response time, and database response times, if
    the frontier tomcat log exists.  This has little to do with
    awstats except that it is needed on the same machines (frontier
    launchpads) and uses the same mechanism for uploading data
    (rsync to frontier.cern.ch).  This data is collected every 5
    minutes instead of the once an hour collection of awstats.
  - Keep track of previously downloaded node name alias and 
    site+project name, in /etc/awstats/awstatsconf.  Then if the
    download (from frontier.cern.ch) fails, re-use the previous
    values.  The chkthread data collection then uses the same file
    so it doesn't need to know how to do the download.
  - Keep the awstats config template in /etc/awstats/awstats.model.conf
    instead of /etc/awstats/awstats.conf so people don't think it is
    an actively used configuration.
  - Keep the first two components of URLs from the squid log instead
    of just the first one; that causes no harm for Frontier (the second
    URL component is always "Frontier") and is helpful for CVMFS.
  - Change directory of support files from /usr/share/awstats to
    /usr/share/frontier-awstats.
  - Remove support for /etc/awstats/customize.sh


author: Dave Dykstra <dwd@fnal.gov> 6.9-1.2
changelog:
  - Remove requirement that /etc/awstats/password-file exists before
    rpm installation.  Create it at install time as an empty file if
    it doesn't exist.
  - Do not install the chkthread cron entries if frontier-tomcat is
    not installed.


author: Dave Dykstra <dwd@fnal.gov> 6.9-3.1
changelog:
  - Update to 6.9-3 tarball which only removes a couple of unused files
  - Remove chkthread monitor generation from this rpm (it is moved to
    frontier-maxthreads rpm)
  - Change awstats monitoring host to be wlcg-squid-monitor.cern.ch
    instead of frontier.cern.ch
  - Remove generation of squidmodifiedqueries, which was a squid log subset
  - Remove relocatability of rpm to simplify it
  - Fully clean up files in /var/lib/frontier-awstats on final uninstall
  - Move release notes into %changelog instead of separate file


author: Dave Dykstra <dwd@fnal.gov> 6.9-3.2
changelog:
  - Keep separate configuration and data directories when frontier-squid is
    configured to run multiple squids, to separately keep statistics on
    each of the squids.


author: Dave Dykstra <dwd@fnal.gov> 6.9-3.3
changelog:
  - Move a temporary file from /tmp to the same directory as the input log
    in case /tmp is too small.


author: Dave Dykstra <dwd@fnal.gov> 6.9-4.3
changelog:
  - Clean out existing /etc/awstats/awstatsconf if any, during post install.
    This was added because at some point a mistake in the mapping file
    caused extra lines to be added to awstatsconf which were causing
    non-fatal error messages.
  - Take only the first match of a node from the mapping file when generating
    awstatsconf.


author: Edita Kizinevic <edita.kizinevic@cern.ch> 6.9-4.4
changelog:
  - Enable IPv6 transport by requiring perl-Socket6 and perl-IO-Socket-INET6
    packages.
  - Add timestamp in the log when the awstats client is finished running.
  - Remove a DNS cache file.


author: Edita Kizinevic <edita.kizinevic@cern.ch> 6.9-5.1
changelog:
  - Change permissions for frontier-awstats data files.
    SaveDatabaseFilesWithPermissionsForEveryone is set to 0 instead of 1.


author: Edita Kizinevic <edita.kizinevic@cern.ch> 6.9-5.2
changelog:
  - Add source frontier-awstats.cron.
  - Add source frontier-awstats.logrotate.
  - Remove frontier-squid requirement.
  - Make changes to run_awstats.sh in order to include httpd access log.


author: Dave Dykstra <dwd@fnal.gov> 6.9-5.3
changelog:
  - Fix the shortening of URLs with syslog logs.
  - Remove %config on /etc/awstats so any edits will be overwritten.


author: Edita Kizinevic <edita.kizinevic@cern.ch> 7.7-1.1
changelog:
  - Upgrade to awstats-7.7
  - Download awstats from official page.
  - Add patch files. wwwroot/cgi-bin/awdownloadcsv.pl and
    wwwroot/cgi-bin/awredir.pl files are removed, wwwroot/cgi-bin
    directory is renamed to awstats. Other directories are removed.


author: Dave Dykstra <dwd@fnal.gov> 7.7-1.2
changelog:
  - Make failure to find httpd alias in mapping file to be non-fatal, because
    that is the normal case on stratum 1s using a frontier-squid frontend.


author: Edita Kizinevic <edita.kizinevic@cern.ch> 7.7-2
changelog:
  - Increase number of records to save in DNS last update cache file from 500
    to 10000.
  - Clear DNS last update cache file once per day.
  - Change run_awstats.sh rsync options from the rsync -av to rsync -rlptv.
  - Process the new data of squid log instead of the whole squid log.
  - Add source collect_pages_data.py. It counts for all combinations of IP
    addresses and the 2 path components.
  - Add Python 3 requirement.
  - Remove 0 from ValidHTTPCodes.


author: Dave Dykstra <dwd@fnal.gov> 7.7-6
changelog:
  - Remove precheck for the $FRONTIER_USER account because it is not
    required for apache-only awstats.


author: Edita Kizinevic <edita.kizinevic@cern.ch> 7.7-8
changelog:
  - Append lines to the end of awstatscron.log instead of overwriting the
    file.
  - Make run_awstats.sh more efficient at looking up host names.


author: Edita Kizinevic <edita.kizinevic@cern.ch> 7.7-10
changelog:
  - Remove use of dnsdomainname in run_awstats.sh.
  - Change shebang to bash instead of sh in run_awstats.sh.


author: Edita Kizinevic <edita.kizinevic@cern.ch> 7.7-8
changelog:
  - Append lines to the end of awstatscron.log instead of overwriting the
    file.
  - Make run_awstat.sh more efficient at looking up host names.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 7.9-1
changelog:
  - Update to AWStats 7.9.
  - Update patches to reflect old patches that were integrated into
    AWStats 7.9.
  - Change "uname -n" to more standard "hostname -f" in script to
    ensure consistent output format.
  - Apply patch corresponding to new AWStats pull request that 
    enables correct display of host name for an IPv6 host.


author: Dave Dykstra <dwd@fnal.gov> 1-3
changelog:
  - install the correct file for logrotate.d; it was accidentally installing
    a copy of the cron.d file into logrotate.d


author: Dave Dykstra <dwd@fnal.gov> 2-1
changelog:
  - Change to be exact match on instance name rather than exact only at the
    end.  In particular, 'atlr' was matching on 't0atlr' log entries.


author: Dave Dykstra <dwd@fnal.gov> 3-1
changelog:
  - Add rsync timeouts to prevent it from hanging indefinitely.
  - Move temporary file to the same directory as catalina.out.


author: Dave Dykstra <dwd@fnal.gov> 4-1
changelog:
  - Fix off-by-one error when looking for where to start next parsing.
    This caused cases of reparsing the whole log when there was no new
    activity in the past 5 minutes.


author: Carl Vuosalo <carl.vuosalo@cern.ch> - 1.2-1
changelog:
  - Make repos specific to OS version: el7, el8, el9, and possibly
     others in the future. Each has a corresponding "-debug" repo.


author: David Front <dfront@gmail.com> 2.7.STABLE9-5.22
changelog:
  - Change $AWSTATS_SCRIPT at fn-local-squid.sh.proto 
    from /etc/awstats/squid_rotate_run_awstats.sh
    to /etc/awstats/run_awstats.sh


author: David Front <dfront@gmail.com> 2.7.STABLE9-5.23
changelog:
  - Change the default NET_LOCAL at /etc/squid/customize.sh to be
    10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 rather than 0.0.0.0/32

    Related: At release notes for frontier-squid-2.7.STABLE9-5:
    at http://frontier.cern.ch/dist/frontier-squid-releasenotes.txt:
    Remove the hidden default of always allowing incoming access to
    private network addresses 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16.
    Instead, make that default explicit in the first customize.sh that
    is generated so if the administrator doesn't want that it can be
    easily changed.


author: David Front <dfront@gmail.com> 2.7.STABLE9-5.24
changelog:
  - Following the recommendation of Dave Dykstra, change /etc/squid/squid.conf
    to be %ghost at the spec file, and hence not installed by the rpm
    but yes removed at rpm uninstall.  As a result, the one line place
    holder of this file is no more needed, and also no need to check for
    small file when testing if this config file should be regenerated,
    at fn-local-squid.sh.proto.


author: David Front <dfront@gmail.com> 2.7.STABLE9-6.1
changelog:
  - Use new release of frontier-squid tarball.  The most significant
    new feature is that multiple squids can be started on the same
    port.  For details of that feature and other tarball changes, see
      http://frontier.cern.ch/dist/frontier-squid-releasenotes.txt
  - Use more of the tarball directly, especially the proto files
  - Use the full version of the rpm to identify the squid process in
    SNMP monitoring
  - A small technical change at the spec file to support source rpms for
    frontier rpms
  - Use symbolic link to unproto.sh to simplify source tar ball creation


author: David Front <dfront@gmail.com> 2.7.STABLE9-7.1
changelog:
  - Use a fix of Dave Dykstra: fixed a small bug in the frontier-squid tarball
    that prevented the hourly cron from reading /etc/sysconfig/frontier-squid 
    for the setting of the LARGE_ACCESS_LOG variable, so it was impossible for
    the user to be able to control the size of the log files kept.


author: David Front <dfront@gmail.com> 2.7.STABLE9-8.1
changelog:
  - Change the init.d 'rotate' command to first remove the oldest log
    files, rather than asking squid to do it, because it can take a long
    time to delete large access logs and squid stops servicing requests
    during the rotate process.


author: Dave Dykstra <dwd@fnal.gov> 2.7.STABLE9-10.1
changelog:
  - Update to frontier-squid-2.7.STABLE9-10 tarball, which changes
    the default SNMP monitoring addresses accepted to be all of the
    WLCG addresses at the main CERN center and the backup CERN
    Hungary data center, and disables the ICP port by default
  - Remove sl5 from the rpm name, as the rpm works for both sl5 & sl6


author: Dave Dykstra <dwd@fnal.gov> 2.7.STABLE9-11.1
changelog:
  - Update to frontier-squid-2.7.STABLE9-11 tarball, which adds the
    Referer and User-Agent headers to the default logformat, and 
    includes the upstream squid source so it self-contained.
  - Fix a rpm spec bug that kept rpmbuild -ba from working


author: Dave Dykstra <dwd@fnal.gov> 2.7.STABLE9-12.1
changelog:
  - Update to frontier-squid-2.7.STABLE9-12 tarball which only
    changes a comment in customize.sh so it can make more sense for
    the rpm
  - Change initial install to not start squid or do chkconfig -add
    to match what the standard Redhat squid rpm does
  - Change upgrades so squid will only be restarted if it was
    running at the time of the upgrade
  - Fix bug that prevented stopping squid when removing the rpm
    while squid is running


author: Dave Dykstra <dwd@fnal.gov> 2.7.STABLE9-13.1
changelog:
  - Update to frontier-squid-2.7.STABLE9-13 tarball which moves the
    output of cron jobs from daily.log in the directory the cron scripts
    are in (/etc/squid/cron) to the directory of the other squid
    logs (default /var/log/squid).
  - Remove the ability to use --prefix at rpm install time to
    relocate, because this greatly simplifies the rpm code including
    no longer needing to install .proto files with the package.
  - Change the cron jobs from being run from the squid user's
    /var/spool/cron (crontab) file to instead being run from 
    /etc/cron.d/frontier-squid.cron.
  - When a user id (default "squid") needs to be created, create it
    as a system account (that is, with a UID lower than the value of
    UID_MIN in /etc/login.defs).
  - If the requested group (default "squid") is missing, create it
    just like a missing user id.
  - Set the ownership of all files under /etc/squid to be the squid
    user instead of leaving some as root.
  - Remove execute permission from files in /etc/squid that don't
    need it.
  - Remove bogus squid doc files from /usr/share/doc.
  - Move the restart of a running process from the post-uninstall to the
    post-install actions.  Note: this has a side effect of causing it to
    restart twice the first time a package is upgraded from the previous
    style to this style.
  - Move the release notes to the rpm changelog.


author: Dave Dykstra <dwd@fnal.gov> 2.7.STABLE9-13.2
changelog:
  - Make /etc/squid/squid.conf a %ghost file so if someone is upgrading
    from a non-frontier squid it won't be overwritten


author: Dave Dykstra <dwd@fnal.gov> 2.7.STABLE9-13.3
changelog:
  - Change the chkconfig behavior to more precisely match Redhat squid's
    package; an administrator will now have to do "chkconfig frontier-squid on"
    instead of "chkconfig --add frontier-squid"
  - Do a few other internal cleanup things to frontier-squid.spec


author: Dave Dykstra <dwd@fnal.gov> 2.7.STABLE9-13.4
changelog:
  - Add /var/cache/squid, /var/log/squid, and /var/run/squid to the list
    of directories installed; they had been accidentally left out


author: Dave Dykstra <dwd@fnal.gov> 2.7.STABLE9-13.5
changelog:
  - Change /var/cache/squid and /var/log/squid to be %ghost and created in
    the post install step in case someone had relocated them with a symlink.
    A symlink in one of those places with the previous version caused the
    target of the symlink to get changed to root ownership.


author: Dave Dykstra <dwd@fnal.gov> 2.7.STABLE9-15.1
changelog:
  - Create the squid user's home directory if it doesn't exist at install
    time, because on RHEL6-derived systems a missing home directory prevents
    cron from running the squid log rotation.
  - Update to frontier-squid-2.7.STABLE9-15 tarball which has the following
    release notes:
    - Put squidcron.log in the same directory as cache.log rather than
      access.log, in case the access_log option is set to "none".  In
      the previous version it would put squidcron.log in the squid
      user's home directory if access_log was "none".
    - Change the init.d startup script to abort with an error message if
      the squid user's home directory does not exist, because on
      RHEL6-derived systems if a user's home directory doesn't exist then
      cron won't run the user's jobs.
    - Run squid without the -S option so it will never run an audit of
      the cache files.  During a normal start the cache is deleted so
      it doesn't matter, and the audit operation can take a very long
      time on a large cache during a restart.  Also an analysis showed
      that the typical types of errors the audit catches (missing files)
      are survivable.
    - Allow multiple background cache cleans to be happening at the same
      time, in case the cache is very large and someone does multiple
      stop/start operations.
    - Add environment variable SQUID_CLEAN_CACHE_ON_START which defaults
      to true and when set to false prevents clearing the cache on start.
      It can be set and exported in the package's /etc/sysconfig file.


author: Dave Dykstra <dwd@fnal.gov> 2.7.STABLE9-16.1
changelog:
  - Fix /etc/init.d/frontier-squid so if an alternate $FRONTIER_USER is
    set in /etc/squid/squidconf, then it will verify the existence of
    that user's home directory rather than the squid user's home directory.
  - Update to frontier-squid-2.7.STABLE9-16 tarball which rearranged the
    /etc/init.d script to be easier to modify at post-install time by
    the rpm, and which changed the delay after starting squid from 3 to
    10 seconds before checking to see if it is running.  That was the
    previous delay before the changes in the last release, and a system
    with 2 squids and slow disk access while cleaning cache in the
    background apparently didn't get started within 3 seconds.


author: Dave Dykstra <dwd@fnal.gov> 2.7.STABLE9-17.1
changelog:
  - Remove the cache when doing a full uninstall
  - When $FRONTIER_USER is not the default value 'squid', automatically
    manage the /etc/cron.d/frontier-squid.cron.rpmnew file that is always
    created
  - Upgrade to frontier-squid-2.7.STABLE9-17 tarball, which has the 
    following release notes:
   - Update the CERN Hungary Data Center's LHCOPN IP address range in
     the HOST_MONITOR access control list from the incorrect
     188.185.0.0/17 to the correct 188.184.128.0/17 and 188.185.128.0/17.
   - Add commented-out acls CMS_FRONTIER, ATLAS_FRONTIER, and MAJOR_CVMFS
     that can be uncommented and used in place of RESTRICT_DEST to
     restrict outgoing connections to the corresponding servers.  This
     allows updating the lists via frontier-squid package upgrades
     rather than requiring individual administrators to know how to keep
     the lists up to date.
   - Include the real time zone in the access.log timestamp instead of
     always +0000, and include milliseconds after the seconds.
   - Add the "cvmfs-info" header to the same double-quoted log entry that
     now has "X-Frontier-Id".  Since no client sends both headers, only
     one will show at a time; frontier entries will end with " -" and
     cvmfs entries will start with "- ".  Cvmfs clients currently only
     send cvmfs-info if configured with CVMFS_SEND_INFO_HEADER=yes so
     if that's not the case their log entries will show "- -".
   - Accept SQUID_MAX_ACCESS_LOG as the variable setting the maximum
     access log file size in place of LARGE_ACCESS_LOG (which is still
     accepted for backward compatibility).  Also if the value ends in
     'M' it indicates megabytes and if it ends in 'G' it indicates
     gigabytes; the default is bytes.
   - Run the "hourly" cron 4 times an hour, to catch faster when a log
     file has gone over the max size limit.
   - Compress log files by default, using logrotate.  If environment
     variable SQUID_COMPRESS_LOGS is exported and set to 'false', fall
     back to the previous method of telling squid to rotate the log
     files without compression.  In either case the logfile_rotate
     configuration parameter is used to define the maximum number of
     rotated files.  If frontier-awstats is also installed, the first
     file is left uncompressed.  When switching either way between
     compressed and uncompressed, removes all log files of the old type.
   - Rotate cache.log even if the access_log configuration parameter is
     "none".
   - Add a new "removecache" option to the init script to simply remove
     all of the cache, for use when removing the package.


author: Dave Dykstra <dwd@fnal.gov> 2.7.STABLE9-18.1
changelog:
  - Upgrade to frontier-squid-2.7.STABLE9-18 tarball, which has the 
    following release notes:
   - Protect rotate operations with a lock, because now that they
     compress files they can take a long time.  This is especially
     important for the one minute between the daily cron and the
     first hourly cron.
   - Fix bug introduced in last release where if access_log is set to
     "none", the cache log is rotated every 15 minutes.


author: Dave Dykstra <dwd@fnal.gov> 2.7.STABLE9-19.1
changelog:
  - Upgrade to frontier-squid-2.7.STABLE9-19 tarball, which has the 
    following release notes:
   - Make the default SQUID_MAX_ACCESS_LOG be 5G instead of 1G unless
     log compression is disabled.  This should take about the same 
     maximum space (~11Gbytes) as uncompressed log files did with a
     max size of 1G.
   - Add the TRIUMF CVMFS stratum 1 to the list in MAJOR_CVMFS.


author: Dave Dykstra <dwd@fnal.gov> 2.7.STABLE9-20.1
changelog:
  - Upgrade to frontier-squid-2.7.STABLE9-20 tarball which has the
    following release notes:
   - Increase the maximum number of squids that may be started from 4
     to 16
   - When running N > 1 squids, limit each squid to the hard limit on
     file descriptors divided by N.  This limiting greatly reduces or
     eliminates the number of failed accesses to cache files indicated
     by TCP_SWAPFAIL_MISS entries in access.log.  Require a minimum of
     4096 file descriptors for each squid, unless customize.sh sets a
     value below the calculated limit.  
   - Support use of SQUID_SUFFIX to add a suffix to all the files.
     This is not supported for use in the standalone tarball, just
     for use within an rpm.
  - Add logrotate as a dependency


author: Dave Dykstra <dwd@fnal.gov> 2.7.STABLE9-21.1
changelog:
  - Upgrade to frontier-squid-2.7.STABLE9-21 tarball which has the
    following release notes:
   - Fix redirection of stderr in the hourly and daily crons so error
     messages properly go to squidcron.log.
   - Only require the minimum 4096 file descriptors when doing one
     of the commands that contain "start" (that is, "start", "restart",
     or "condrestart") with multiple squids.
   - Add the script that generates squid.conf to the list of files that
     trigger regenerating squid.conf if they're newer than squid.conf.
   - Only generate the per-squid configuration files used with multiple
     squids when squid.conf is newer than them.


author: Dave Dykstra <dwd@fnal.gov> 2.7.STABLE9-22.1
changelog:
  - Upgrade to frontier-squid-2.7.STABLE9-22 tarball which has the
    following release notes:
   - Apply patch from Debian that was backported from a denial of
      service vulnerability reported for squid3 in CVE-2014-3609,
      having to do with an invalid "Range" header request.
   - Make slight correction to MAJOR_CVMFS acl regular expression.
   - Expand the server names allowed at RAL in the ATLAS_FRONTIER acl.
  - On final un-install, remove the generated configuration files used
    for running multiple squids at /etc/squid/.squid-*.conf


author: Dave Dykstra <dwd@fnal.gov> 2.7.STABLE9-23.1
changelog:
  - Upgrade to frontier-squid-2.7.STABLE9-23 tarball which has the
    following release notes:
   - Back out the dividing up of file descriptors between multiple squids
     that was added in frontier-squid-2.7.STABLE9-20.  It was based on a
     confusion over how the limit worked; the file descriptor limit works
     per process and not per user.
   - Support new configuration option SQUID_MULTI_PEERING=false to not
     insert cache_peer parent settings when there are multiple squids.
     By default when there are multiple squids, any squid other than the
     first one reads from the first one like it always used to.
   - Support using multiple squids for a reverse proxy.  Formerly it
     clobbered the http_port and cache_peer parent settings when using
     multiple squids.  Now it preserves any extra parameters on
     http_port and sets SQUID_MULTI_PEERING=false if a cache_peer parent
     setting already exists.
   - Support awstats with multiple squids: invoke run_awstats.sh if it
     exists (installed by frontier-awstats rpm) for the logs of all of
     the squids and not just the first one.  Requires frontier-awstats
     rpm version 6.9-3.2 or newer to work properly.
   - Don't invoke awstats if SQUID_SUFFIX is set (that is, in the
     frontier-squid2 rpm) so it won't get invoked twice when it
     is installed simultaneously with frontier-squid.
   - Support a "daemon:" prefix on access_log and cache_log, a poorly
     documented squid feature that uses a separate process to handle
     writing to log files so the main squid process doesn't have to
     wait for disk I/O.  This was added because log compression was
     observed on one machine to interfere with squid I/O accesses.
     Make this the default for access_log.
   - Run log rotation with ionice -n7.


author: Dave Dykstra <dwd@fnal.gov> 2.7.STABLE9-24.1
changelog:
  - Upgrade to frontier-squid-2.7.STABLE9-24 tarball which has the
    following release note:
   - Fix the disabling of log compression with the SQUID_COMPRESS_LOGS=false
     setting.  The variable was not being honored in the nightly log rotate
     cron, so log compression still happened at night.  It was being 
     honored in the every 15 minute check, so if the maximum log size
     was reached during the day it removed all the compressed files
     that were rotated overnight, losing log history.


author: Dave Dykstra <dwd@fnal.gov> 2.7.STABLE9-24.2
changelog:
  - Add creation of config file in /usr/lib/tmpfiles.d to create /run/squid
    directory on reboot of EL7-based systems.


author: Dave Dykstra <dwd@fnal.gov> 2.7.STABLE9-25.1
changelog:
  - Upgrade to frontier-squid-2.7.STABLE9-25 tarball which has the
    following release notes:
   - Apply fix for reported security vulnerability CVE-2016-4554.  It
     is only for transparent proxies which is not the way frontier-squid
     is normally used, but the patch is applied just in case.  Also
     discussed in http://bugs.squid-cache.org/show_bug.cgi?id=4501
     and http://bugs.squid-cache.org/show_bug.cgi?id=4515.
   - Add hepvm.cern.ch to the MAJOR_CVMFS acl.


author: Dave Dykstra <dwd@fnal.gov> 2.7.STABLE9-26.1
changelog:
  - Upgrade to frontier-squid-2.7.STABLE9-26 tarball which has the
    following release note:
   - Change default minimum_expiry_time to 0 seconds.  Without this
     change, squid will not cache any objects that are loaded for the
     first time during the last minute of their lifetime; instead, all
     requests for that object during that minute are sent upstream.  It
     only affects squids that are fed by other squids.


author: Dave Dykstra <dwd@fnal.gov> 2.7.STABLE9-27.1
changelog:
  - Upgrade to frontier-squid-2.7.STABLE9-27 tarball which has the
    following release notes:
   - When using compressed logs and SQUID_CLEAN_CACHE_ON_START is true
     (both of which are default), then truncate the swap.state file
     in ufs cache directories each time logs are rotated.  Otherwise the
     file grows without bounds.
   - When using the 'restart' function, clean ufs cache directories the
     same way as when doing 'start'.
   - Change the default cache_dir size in squid.conf.proto to 10000 MB in
     case someone deletes the default 10000 MB line in customize.sh.


author: Dave Dykstra <dwd@fnal.gov> 3.5.19-2.1
changelog:
  - Upgrade to 3.5.19-2 tarball with the following release note:
   - Add support for SQUID_CUSTOMIZE environment variable.  If set to
     false it skips generating squid.conf from squid.conf.frontierdefault
     and customize.sh.  Instead, the user is on his or her own to manage
     squid.conf.  It is recommended to start from squid.conf.default
     because that is less likely to change between releases.  The default
     setting of SQUID_CUSTOMIZE is true.


author: Dave Dykstra <dwd@fnal.gov> 3.5.19-3.1
changelog:
  - Upgrade to 3.5.19-3 tarball with the following release note:
   - Change default minimum_expiry_time to 0 seconds.  Without this
     change, squid will not cache any objects that are loaded for the
     first time during the last minute of their lifetime; instead, all
     requests for that object during that minute are sent upstream.  It
     only affects squids that are fed by other squids.


author: Dave Dykstra <dwd@fnal.gov> 3.5.19-3.2
changelog:
  - Disable external acl helpers, auth digest helpers, and the LDAP
    auth basic helper, because they interfered with having an el5
    rpm be upward compatible to el7 (in particular, libsasl and libdb).


author: Dave Dykstra <dwd@fnal.gov> 3.5.20-1.1
changelog:
  - Upgrade to 3.5.20-1 tarball with the following release notes:
   - Upgrade to squid-3.5.20.  This is the release announcement:
      http://www.spinics.net/lists/squid/msg82165.html
   - Replace my own patches for squid bugs #4311 and #4471 with a big
     patch from Alex Rousskov fixing collapsed revalidation.  It
     addresses bug #4311 and more importantly bug #2833, where collapsed
     forwarding did not work with If-Modified-Since on expired objects.
     Unfortunately it breaks the functionality formerly fixed in the
     patch for bug #4471; that is, collapsed forwarding now does not
     work on expired objects that do *not* have a Last-Modified header.
     This should be no problem for the Frontier application because any
     response without Last-Modified is given a year expiration time.
     However, this is a potential issue for CVMFS because the stratum 1s
     currently expire most objects after 3 days.  At least the issue
     will be relatively infrequent, and if a fix for this bug does not
     come soon we can probably eventually get the stratum 1
     configurations changed to increase the expiration time.


author: Dave Dykstra <dwd@fnal.gov> 3.5.20-2.1
changelog:
  - Upgrade to 3.5.20-2 tarball with the following release notes:
   - The infamous squid bug #7 had partially cropped up again.  The Date
     headers on cached 304 Not Modified responses on large objects was
     returning the original Date rather than a new re-validated Date,
     even though the Age header was correct.   This causes many
     duplicated queries to get sent upstream.  This release works around
     the problem as discussed here:
      http://bugs.squid-cache.org/show_bug.cgi?id=7#c79


author: Dave Dykstra <dwd@fnal.gov> 3.5.20-3.1
changelog:
  - Upgrade to 3.5.20-3 tarball with the following release notes:
   - Apply patch from the squid team for bug #4428.  This bug causes 
      the Cache-control: stale-if-error header, which Frontier uses,
      to be malformed in cached objects.
   - Fix bug that caused access logs shared by multiple workers to be
      rotated multiple times, once for each worker, instead of just once.
   - When using compressed logs and SQUID_CLEAN_CACHE_ON_START is true
     (both of which are default), then truncate the swap.state file
     in ufs cache directories each time logs are rotated.  Otherwise the
     file grows without bounds.
   - When using the 'restart' function, clean ufs cache directories the
     same way as when doing 'start'.


author: Dave Dykstra <dwd@fnal.gov> 3.5.21-1.1
changelog:
  - Upgrade to 3.5.21-1 tarball with the following release notes:
   - Upgrade to squid-3.5.21 with release notes at
      http://www.spinics.net/lists/squid/msg83169.html
   - Remove patch for bug #4428, it is now in the release.
   - Apply patch from Alex Rousskov for squid bug #4471, fixing collapsed
      forwarding revalidation when there is no If-Modified-Since.
   - Change "%Hs" in the default log format to the new style ">%Hs" for
      squid-3.
   - Change the default cache_dir size in squid.conf.proto to 10000 MB in
      case someone deletes the default 10000 MB line in customize.sh.
   - Change the script that applies patches to exit with an error if any
      of the patches are not completely applied.


author: Dave Dykstra <dwd@fnal.gov> 3.5.21-2.1
changelog:
  - Upgrade to 3.5.21-2 tarball with the following release note:
   - Fix error in the new logformat.  It should be "%>Hs", not ">%Hs".


author: Dave Dykstra <dwd@fnal.gov> 3.5.22-1.1
changelog:
  - Upgrade to 3.5.22-1 tarball with the following release notes:
   - Upgrade to squid-3.5.22 with release notes at
      http://www.spinics.net/lists/squid/msg83740.html
   - Remove patches from Alex Rousskov because they are now in the
     official squid 3.5 release.


author: Dave Dykstra <dwd@fnal.gov> 3.5.22-2.1
changelog:
  - Upgrade to 3.5.22-2 tarball with the following release note:
   - Change default value of dns_v4_first to "on", so it will always try
     ipv4 first if available and then ipv6.  The default was "off" which
     always tries ipv6 first.


author: Dave Dykstra <dwd@fnal.gov> 3.5.23-1.1
changelog:
  - Upgrade to 3.5.23-1 tarball with the following release notes:
   - Upgrade to squid-3.5.23 with release notes at
       http://www.spinics.net/lists/squid/msg84536.html
     The most notable changes are fixes for two privacy vulnerabilities.
     They don't affect the applications primarily used with frontier-squid
     but may affect other applications.
   - Add the CERN IPv6 monitoring address range to the HOST_MONITOR acl.
   - Add IPv6 private net addresses to default setting of NET_LOCAL.


author: Dave Dykstra <dwd@fnal.gov> 3.5.23-2.1
changelog:
  - Upgrade to 3.5.23-2 tarball with the following release note:
   - Comment out the fix for security advisory SQUID-2016:10, because it
     caused collapsed forwarding to break for If-Modified-Since requests.
     It was probably implemented incorrectly; discussion is in the
     reopened squid bug report #2833.


author: Dave Dykstra <dwd@fnal.gov> 3.5.23-3.1
changelog:
  - Upgrade to 3.5.23-3 tarball with the following release note:
   - Replace my patch that comments out the fix for security advisory
     SQUID-2016:10 with a patch from the consultant for bug #2833.  This
     patch makes collapsed forwarding work again with If-Modified-Since
     while leaving the security advisory fixed.


author: Dave Dykstra <dwd@fnal.gov> 3.5.23-4.1
changelog:
  - Upgrade to 3.5.23-4 tarball with the following release notes:
   - Replace the bug #2833 fix with a newer version from the consultant.  The
     full name is SQUID-252-collapsed-slaves-non-sharable-responses-3.5-t6.
     It is probably not the final patch.
   - Add creation of /var/run/squid in the init.d script, if it did not
     exist.  This is because systemd-based systems (EL7) do not preserve
     the directory across boots, and on some systems the systemd
     configuration file to create it at boot time does not work.  That
     can happen if the system gets user ids from the network, so the
     squid user id might not yet be available when the systemd
     configuration file is used.
  - Add a systemd service descriptor configuration, primarily to make sure
     that frontier-squid is started after networking services.  Uses the
     same "After" and "Wantedby" targets as apache httpd.


author: Dave Dykstra <dwd@fnal.gov> 3.5.23-5.1
changelog:
  - Upgrade to 3.5.23-5 tarball with the following release note:
   - Replace the bug #2833 fix with a newer version from the consultant.  The
     full name is SQUID-252-collapsed-slaves-non-sharable-responses-3.5-t9.
     The previous version is suspected in a crash at one grid site. This
     version required a couple of small changes to apply and compile cleanly.


author: Dave Dykstra <dwd@fnal.gov> 3.5.23-6.1
changelog:
  - Upgrade to 3.5.23-6 tarball with the following release notes:
   - Replace the bug #2833 fix with a newer version from the consultant.  The
     full name is SQUID-252-collapsed-slaves-non-sharable-responses-3.5-t10.
     This one might be final.
   - Add patch from squid bug #4616, since two users had reported the "mem"
     assertion failure in store_client.cc.  The full name of the patch is
     bug4616-cf-mem-assert-t1.


author: Dave Dykstra <dwd@fnal.gov> 3.5.24-1.1
changelog:
  - Upgrade to 3.5.24-1 tarball with the following release notes:
   - Upgrade to squid-3.5.24 with release notes at
       https://www.spinics.net/lists/squid/msg85024.html
     The bug fixes we had been including are not yet in this release, so
     all the same patches are kept.  The most notable change affecting
     WLCG in this release was a fix for a bug that caused 'cache deny'
     to not have any effect.  That is used for some cvmfs stratum 1s,
     and perhaps other applications.


author: Dave Dykstra <dwd@fnal.gov> 3.5.24-2.1
changelog:
  - Upgrade to 3.5.24-2 tarball with the following release notes:
   - Change the default setting of quick_abort_min from -1 KB to 1 GB and
     the default setting of quick_abort_max from 16 KB to 1 GB.  This is
     to work around the squid crash documented in squid bug #4554.  A
     consequence is that when a client aborts an object download, the
     object won't get cached even though it is highly likely that
     another client will soon want the same object.


author: Dave Dykstra <dwd@fnal.gov> 3.5.24-3.1
changelog:
  - Upgrade to 3.5.24-3 tarball with the following release notes:
   - Change quick_abort_min and quick_abort_max once again, this time to
     0 KB, because someone doing a different repeatable test found that
     the 1 GB value still caused some crashes but 0 KB didn't.


author: Dave Dykstra <dwd@fnal.gov> 3.5.27-1.1
changelog:
  - Upgrade to 3.5.27-1 tarball with the following release notes:
   - Upgrade to squid-3.5.27.  The release announcement hasn't been
     published yet but here is the ChangeLog:
       https://github.com/squid-cache/squid/blob/v3.5/ChangeLog
     Release notes from prior releases since last frontier-squid release:
       https://www.spinics.net/lists/squid/msg86349.html (3.5.26)
       https://www.spinics.net/lists/squid/msg85634.html (3.5.25)
   - Remove the patch from #2833 because it was updated and included in
      the 3.5.27 release.
   - Add a patch from #4766 for making IPv6 SNMP queries work with
      multiple worker processes instead of causing a crash & restart.
   - Add IHEP and UNL stratum ones to the MAJOR_CVMFS access control list.


author: Dave Dykstra <dwd@fnal.gov> 3.5.27-1.1
changelog:
  - Upgrade to 3.5.27-1 tarball with the following release notes:
   - Upgrade to squid-3.5.27.  The release announcement hasn't been
     published yet but here is the ChangeLog:
       https://github.com/squid-cache/squid/blob/v3.5/ChangeLog
     Release notes from prior releases since last frontier-squid release:
       https://www.spinics.net/lists/squid/msg86349.html (3.5.26)
       https://www.spinics.net/lists/squid/msg85634.html (3.5.25)
   - Remove the patch from #2833 because it was updated and included in
      the 3.5.27 release.
   - Add a patch from #4767 for making IPv6 SNMP queries work with
      multiple worker processes instead of causing a crash & restart.
   - Add IHEP and UNL stratum ones to the MAJOR_CVMFS access control list.


author: Dave Dykstra <dwd@fnal.gov> 3.5.27-2.1
changelog:
  - Upgrade to 3.5.27-2 tarball with the following release note:
   - Add openhtc.io aliases to CMS_FRONTIER, ATLAS_FRONTIER, and MAJOR_CVMFS
     acls.


author: Dave Dykstra <dwd@fnal.gov> 3.5.27-3.1
changelog:
  - Upgrade to 3.5.27-3 tarball with the following release notes:
   - Add configuration options to always honor "Pragma: no-cache" from a
     client, even if the client also sends a "Cache-control" header, as
     the current frontier-client (v2.8.20) always does.
       https://bugs.squid-cache.org/show_bug.cgi?id=4809
   - Included provided patches from the squid project related to two
     denial of service security advisories which they say could affect
     all reverse proxies.
      http://www.squid-cache.org/Advisories/SQUID-2018_1.txt
      http://www.squid-cache.org/Advisories/SQUID-2018_2.txt
     For example frontier server launchpad squids are configured as
     reverse proxies.


author: Dave Dykstra <dwd@fnal.gov> 3.5.27-4.1
changelog:
  - Upgrade to 3.5.27-4 tarball with the following release note:
   - If the maximum listen backlog (sysctl net.core.somaxconn) is less than
     1/4th the file descriptor limit (ulimit -n) when starting squid,
     increase it to that amount.  That's the listen backlog that squid
     requests, and the larger backlog helps when a server is hit so hard
     with requests that squid can't keep up.


author: Dave Dykstra <dwd@fnal.gov> 3.5.27-5.1
changelog:
  - Upgrade to 3.5.27-5 tarball with the following release note:
   - Avoid a reverse DNS lookup for every client connection by using the
     workaround in https://bugs.squid-cache.org/show_bug.cgi?id=4575,
     which is to override the defaults for url_rewrite_extras and
     store_id_extras.


author: Dave Dykstra <dwd@fnal.gov> 3.5.27-5.2
changelog:
  - Add %verify (not user group) to the %ghost statements for cache dir
    and log dir, and add %verify (not user group mode) on squid.conf and
    squid.conf.old.  Without those, rpm -V complains on el7 only, not el6.


author: Dave Dykstra <dwd@fnal.gov> 3.5.28-1.1
changelog:
  - Upgrade to 3.5.28-1 tarball with the following release note:
   - Update to squid-3.5.28.  Here is the release announcement:
      https://www.mail-archive.com/squid-announce@lists.squid-cache.org/msg00083.html
      Removed patches for advisories SQUID-2018_1 and SQUID-2018_2 and
      for bug 4767 because fixes are included in the release.
   - Remove including /etc/init.d/functions from fn-local-squid.sh and from
     /etc/init.d/frontier-squid.  It wasn't being used and isn't in some
     docker containers such as slc6-lite.
   - If there are *.log.0.gz files in the presence of awstats, remove
     them before rotating.  They prevented rotation from working on el7.
  - When creating an account for running squid under, use a home directory of
     /var/lib/squid instead of defaulting to /home/${FRONTIER_USER:-squid}.
     The old default doesn't work on systems with automounted /home.


author: Dave Dykstra <dwd@fnal.gov> 3.5.28-1.1
changelog:
  - Upgrade to 3.5.28-1 tarball with the following release notes:
   - Update to squid-3.5.28.  Here is the release announcement:
      https://www.mail-archive.com/squid-announce@lists.squid-cache.org/msg00083.html
      Removed patches for advisories SQUID-2018_1 and SQUID-2018_2 and
      for bug 4767 because fixes are included in the release.
   - Remove including /etc/init.d/functions from fn-local-squid.sh and from
     /etc/init.d/frontier-squid.  It wasn't being used and isn't in some
     docker containers such as slc6-lite.
   - If there are *.log.0.gz files in the presence of awstats, remove
     them before rotating.  They prevented rotation from working on el7.
  - When creating an account for running squid under, use a home directory of
     /var/lib/squid instead of defaulting to /home/${FRONTIER_USER:-squid}.
     The old default doesn't work on systems with automounted /home.


author: Dave Dykstra <dwd@fnal.gov> 3.5.28-2.1
changelog:
  - Upgrade to 3.5.28-2 tarball with the following release notes:
   - Set umask and PATH in fn-local-squid.sh because /etc/init.d/functions
     used to set them.  This fixes problems with log rotation from cron.
   - Invoke /etc/init.d/functions from /etc/init.d/frontier-squid if it
     exists, because that is how systemd-based systems invoke systemctl
     to keep track of the service.  If it does not exist, set the PATH.


author: Dave Dykstra <dwd@fnal.gov> 3.5.28-3.1
changelog:
  - Upgrade to 3.5.28-3 tarball with the following release notes:
   - Apply patch for security advisory SQUID-2018:5 which fixes a memory leak
      for rejected SNMP requests.  This could result in a denial of service
      as memory is allocated and not freed from many requests.
   - If different squid services have different numbers of workers (for
      example by using setserviceoption on "workers") then use the biggest
      number when creating cache and log directories.


author: Dave Dykstra <dwd@fnal.gov> 4.6-2.1
changelog:
  - Upgrade to 4.6-2 tarball with the following release notes:
   - Add support for sending access_log through syslog
   - Add additional allowed monitoring host CERN IP range of 188.185.48.0/20


author: Dave Dykstra <dwd@fnal.gov> 4.4-2.1
changelog:
  - Upgrade the 4.4-1.1 version to the 4.4-2 tarball with the following
     release note:
   - Apply security patch for CVE-2019-12527
        http://www.squid-cache.org/Advisories/SQUID-2019_5.txt
      which can (before being patched) be exploited through the ftp protocol.


author: Dave Dykstra <dwd@fnal.gov> 4.8-1.1
changelog:
  - Upgrade to 4.8-1 tarball with the following release notes:
   - Update to squid-4.8 with release notes at
      https://www.mail-archive.com/squid-announce@lists.squid-cache.org/msg00096.html
     There was no 4.7 announcement but here's the ChangeLog:
      https://github.com/squid-cache/squid/blob/f977bfa698ab92e9474c775cef0e01fb756a4b0f/ChangeLog


author: Dave Dykstra <dwd@fnal.gov> 4.8-2.1
changelog:
  - Upgrade to 4.8-2 tarball with the following release note:
   - Add support for starting and stopping shoal-agent when installed and
     enabled by SQUID_AUTO_DISCOVER=true
  - Add compilation and installation for shoal-agent


author: Dave Dykstra <dwd@fnal.gov> 4.9-1.1
changelog:
  - Upgrade to 4.9-1 tarball with the following release notes:
   - Update to squid-4.9 with release notes at
      http://squid-web-proxy-cache.1019090.n4.nabble.com/squid-announce-Squid-4-9-is-available-td4688506.html
   - Add cvmfs01.nikhef.nl, cvmfs-stratum-one.zeuthen.desy.de, and
      grid-cvmfs-one.desy.de to the MAJOR_CVMFS acl.


author: Dave Dykstra <dwd@fnal.gov> 4.9-2.1
changelog:
  - Upgrade to 4.9-2 tarball with the following release note:
   - Fix bug in daily cron that prevented it from rotating any logs


author: Dave Dykstra <dwd@fnal.gov> 4.9-3.1
changelog:
  - Upgrade to 4.9-3 tarball with the following release notes:
   - Apply a patch for bug #4735, to prevent caching an object when its
      http/1.1 last chunk (that is, zero-length chunk) is missing.
   - Disable the URN proto by default, to avoid potential future security
      vulnerabilities.
   - Fail if the hard nofile ulimit for the squid user is less than 4096
      (which is unlikely since it is the default value on RHEL6 & 7) and
      increase the soft nofile ulimit to match the hard limit.  Squid
      uses the soft limit as the default max_filedescriptors.  Previously
      the root portion of the startup script attempted to increase the
      soft limit to 4096, but it turned out to have no effect because
      runuser resets it to its default for that user.


author: Dave Dykstra <dwd@fnal.gov> 4.9-4.1
changelog:
  - Upgrade to 4.9-4 tarball with the following release note:
   - Limit the hard nofile ulimit check to the "start" operation.


author: Dave Dykstra <dwd@fnal.gov> 4.9-5.1
changelog:
  - Upgrade to 4.9-4 tarball with the following release note:
   - Change compressing log rotation to not use logrotate's copytruncate.
      Instead, use create and a postrotate that sends squid a reconfigure
      signal.  This is needed when using rsyslog's imfile module to copy
      to syslog, but also greatly speeds up rotation when log files are
      large.


author: Dave Dykstra <dwd@fnal.gov> 4.10-1.1
changelog:
  - Upgrade to 4.10-1 tarball with the following release notes:
   - Update to squid-4.10, with release notes at
      https://www.mail-archive.com/squid-announce@lists.squid-cache.org/msg00103.html
     including a fix for a serious security vulnerability affecting
     reverse proxies and a potential information leak when proxying ftp.
   - Remove patch for bug #4735, as it has been included in the 4.10 release.
   - Change compressing log rotation back to use copytruncate when there
     are multiple workers, because the reconfigure signal triggers an
     SNMP bug when there are multiple workers (squid bug #5022).
   - Disable log rotatation when SQUID_MAX_ACCESS_LOG=0.  Using this is
      highly discouraged since standard logrotate is usually unable to
      keep up with the high volume of logs typically generated by squid.
      It also interferes with frontier-awstats support.
   - Change log rotating cron scripts to ignore commented lines in
      /etc/sysconfig/frontier-squid


author: Dave Dykstra <dwd@fnal.gov> 4.10-2.1
changelog:
  - Upgrade to 4.10-2 tarball with the following release notes:
   - Apply patch for squid bug #5022, to prevent a reconfigure from crashing
      the coordinator process when there are multiple workers.
   - Use reconfigure signal for log rotation in all cases again.


author: Dave Dykstra <dwd@fnal.gov> 4.10-3.1
changelog:
  - Upgrade to 4.10-3 tarball with the following release notes:
   - Update patch for squid bug #5022 to final version.
   - Add patch for squid bug #5030 which reported that negative caching
      was not working.  This is an important feature for keeping load
      down on CVMFS stratum 1s that are not hosting a repository.


author: Dave Dykstra <dwd@fnal.gov> 4.10-4.1
changelog:
  - Upgrade to 4.10-4 tarball with the following release note:
   - Add patch for bug 5036 which caused a varying number of capital 'L's
      to appear at the beginning of access.log lines when the log buffer
      overflows.


author: Dave Dykstra <dwd@fnal.gov> 4.11-1.1
changelog:
  - Upgrade to 4.11-1 tarball with the following release notes:
   - Update to squid-4.11.  There's no announcement yet but the change log
      is at http://www.squid-cache.org/Versions/v4/changesets/.
   - Remove patches for bugs #5022 and #5036 which are in version 4.11. The
      patch for #5030 is still applied.


author: Dave Dykstra <dwd@fnal.gov> 4.11-2.1
changelog:
  - Upgrade to 4.11-2 tarball with the following release notes:
   - The 4.11 release announcement is now at
       https://www.mail-archive.com/squid-announce@lists.squid-cache.org/msg00108.html
      The announcement was delayed because security vulnerabilities were
      being double-checked.
   - frontier-squid was not susceptible to the ESI vulnerability, because of
      missing libraries on the build machine.  Add --disable-esi to make
      sure it doesn't get accidentally enabled.


author: Dave Dykstra <dwd@fnal.gov> 4.11-3.1
changelog:
  - Upgrade to 4.11-3 tarball with the following release notes:
   - Apply patch for bug #5051 which prevents a negative cache from
      persisting indefinitely with if-modified-since and collapsed forwarding.
   - Fix shoal when there are multiple squid workers.
   - Add cc.*\.in2p3\.fr to MAJOR_CVMFS.  It was already in ATLAS_FRONTIER
      so it was included for installations that accept both, but not for
      those that accept only MAJOR_CVMFS.


author: Dave Dykstra <dwd@fnal.gov> 4.11-4.1
changelog:
  - Upgrade to 4.11-4 tarball with the following release note:
    - Apply patch for bug #5041 which broke compilation in squid-4.11 on
      el7 with systemd.
  - Update rpm spec to build on el8.
  - Use python3 for shoal instead of python2 because that has the greatest
    portability across operating systems.  On el6, use the scl add-on
    package from Red Hat.  Apply a patch to shoal to work with python3.  
  - Pre-download python pip packages into shoal-downloads.tar.gz to include
    them in the src rpm.
  - Disable NIS basic-authentication on el8 because required header files
    are missing


author: Dave Dykstra <dwd@fnal.gov> 4.11-4.2
changelog:
  - Fix quoting on el6 build options to select the correct types of basic
    authentication.  The bug accidentally enabled ldap authentication which
    prevented an el6 rpm from installing on el7.
  - Remove openldap-devel build dependency.


author: Dave Dykstra <dwd@fnal.gov> 4.11-4.3
changelog:
  - Require systemd-devel on non-el6 systems, so squid's configure will
    recognize that it is on a systemd-based system.
  - Update to shoal-agent-0.9.9, and remove python3 patch because that
    is now merged.


author: Dave Dykstra <dwd@fnal.gov> 4.12-2.1
changelog:
  - Upgrade to 4.12-2 tarball with the following release notes (from 4.12-1
     and 4.12-2):
   - Update to squid-4.12 with release announcement at
       https://www.mail-archive.com/squid-announce@lists.squid-cache.org/msg00114.html
      It includes a couple of security advisories, but the are on
      features that as far as I know are not used by frontier-squid users.
   - Remove patches for bug #5030 and #5041 which are included in 4.12
   - Slightly update patch for bug #5051 as recommended by squid consultant
   - Note that an additional, more relevant squid advisory fixed in 4.12 was
      published late:
       https://www.mail-archive.com/squid-announce@lists.squid-cache.org/msg00116.html
   - Support the "stdio:" prefix for access_log


author: Dave Dykstra <dwd@fnal.gov> 4.12-2.1
changelog:
  - Upgrade to 4.12-2 tarball with the following release notes (from 4.12-1
     and 4.12-2):
   - Update to squid-4.12 with release announcement at
       https://www.mail-archive.com/squid-announce@lists.squid-cache.org/msg00114.html
      It includes a couple of security advisories, but they are on
      features that as far as I know are not used by frontier-squid users.
   - Remove patches for bug #5030 and #5041 which are included in 4.12
   - Slightly update patch for bug #5051 as recommended by squid consultant
   - Note that an additional, more relevant squid advisory fixed in 4.12 was
      published late:
       https://www.mail-archive.com/squid-announce@lists.squid-cache.org/msg00116.html
   - Support the "stdio:" prefix for access_log


author: Dave Dykstra <dwd@fnal.gov> 4.13-1.1
changelog:
  - Upgrade to 4.13-1tarball with the following release notes:
   - Update to squid-4.13 with release announcement at
       https://www.mail-archive.com/squid-announce@lists.squid-cache.org/msg00117.html
      It includes a couple of relevant security advisories related to
      cache poisoning.
   - Remove patch for bug 5051 since it is included in the 4.13 release.
  - Remove the recursion on the restorecon for SELinux in the %post install
      step, to avoid taking a long time when going through a large cache.


author: Dave Dykstra <dwd@fnal.gov> 4.13-1.1
changelog:
  - Upgrade to 4.13-1 tarball with the following release notes:
   - Update to squid-4.13 with release announcement at
       https://www.mail-archive.com/squid-announce@lists.squid-cache.org/msg00117.html
      It includes a couple of relevant security advisories related to
      cache poisoning.
   - Remove patch for bug 5051 since it is included in the 4.13 release.
  - Remove the recursion on the restorecon for SELinux in the %post install
      step, to avoid taking a long time when going through a large cache.


author: Dave Dykstra <dwd@fnal.gov> 4.13-2.1
changelog:
  - Upgrade to 4.13-2 tarball with the following release note:
   - Move temporary logrotate config file to the log directory, to keep
     SELinux on CentOS8 happy.


author: Dave Dykstra <dwd@fnal.gov> 4.13-3.1
changelog:
  - Upgrade to 4.13-3 tarball with the following release notes:
   - Change log rotates to no longer use reconfigure signal but to instead
      set logfile_rotate to zero and use the rotate signal.  This is much
      lighter weight and works around squid bug #5113.  Administrators can
      still set logfile_rotate to non-default values, but it is used only
      by fn-local-squid.sh and overridden for squid.
   - With multiple squid services, send the rotate signal only once to each
      squid.
   - Add timestamps to squidcron.log for the beginning and end of rotation.
  - Remove el6 support


author: Dave Dykstra <dwd@fnal.gov> 4.13-4.1
changelog:
  - Increase shoal-agent version to 1.0.0.
  - Upgrade to 4.13-4 tarball with the following release notes:
   - Add Compute Canada stratum 1s to MAJOR_CVMFS
   - Add any parameters passed in by $SQUID_START_ARGS to the starting of
      squid.  This is set to --foreground by the OSG frontier-squid docker
      container.


author: Dave Dykstra <dwd@fnal.gov> 4.13-5.1
changelog:
  - Upgrade to 4.13-5 tarball with the following release notes:
   - Use /bin/bash instead of $SHELL in fn-local-squid.sh because $SHELL
      is sometimes set to /bin/nologin (in particular when the squid user
      directly invokes fn-local-squid.sh).  This affected cleaning out old
      cache files and starting shoal.
   - Do not attempt to set net.core.somaxconn higher than the kernel
      maximum of 65335.


author: Dave Dykstra <dwd@fnal.gov> 4.13-5.2
changelog:
  - Fix bad permissions on one of the shoal-agent dependency directories.
    Only caused a problem when rebuilding from src rpm.


author: Dave Dykstra <dwd@fnal.gov> 4.15-1.1
changelog:
  - Upgrade to 4.15-1 tarball with the following release notes:
   - Update to squid-4.15 with release announcement at
       http://lists.squid-cache.org/pipermail/squid-announce/2021-May/000127.html
      The update includes security fixes, and at least one (SQUID-2020:11)
      is relevant because it enables someone that is allowed by access
      controls to use squid for some purpose to bypass any other access
      controls and use it for any purpose.  That one can be worked around
      with "uri_whitespace deny", but other denial of service vulnerabilities
      fixed in this version have no workaround.
   - Set "uri_whitespace deny" by default to avoid any other related
      vulnerabilities in the future.
   - Exit with an error if either of the two required logfile_rotate entries
      are not in squid.conf.  This is for the protection of who are using
      SQUID_CUSTOMIZE=false and have not properly merged the changes from
      squid.conf.frontierdefault.
   - Update the customhelps.awk function setoption() to work correctly
      after a setoptionparameter().
   - Allow cache_dir null type which means no disk cache, for systems that
      have very large cache_mem and maximum_object_size_in_memory.


author: Dave Dykstra <dwd@fnal.gov> 4.15-1.2
changelog:
  - Filter out unneeded python3 dependency added by rpm's automatic
    dependency generation, by overriding /usr/lib/rpm/redhat/find-requires macro.


author: Dave Dykstra <dwd@fnal.gov> 4.15-2.1
changelog:
  - Upgrade to 4.15-2 tarball with the following release notes:
   - Fix SQUID_COMPRESS_LOGS=false, which was broken since 4.13-3.  Change
      it to also use the external logrotate command instead of the squid
      builtin log rotation.


author: Edita Kizinevic <edita.kizinevic@cern.ch> 4.17-1.1
changelog:
  - Upgrade to 4.17-1 tarball with the following release notes:
   - Update to squid-4.17.  Includes squid-4.16 with release announcement at
       http://lists.squid-cache.org/pipermail/squid-announce/2021-July/000134.html
      and squid-4.17 with release announcement at
       http://lists.squid-cache.org/pipermail/squid-announce/2021-October/000137.html
      The latter includes a security fix, but it is to code disabled in
      frontier-squid.
  - Avoid including standard system libraries with pyinstaller.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 4.17-2.1
changelog:
  - Upgrade to 4.17-2 tarball with the following release notes:
   - Add sites sampacs*.if.usp.br and cvmfs-*.hpc.swin.edu.au to MAJOR_CVMFS in
       squid/files/postinstall/squid.conf.proto.


author: Dave Dykstra <dwd@fnal.gov> 4.3-1.1
changelog:
  - Upgrade to 4.3-1 tarball with the following release notes:
   - Major update to squid-4.3.
   - Removed patch for bug 4616 (patch was already applied in 4.3).
   - Replaced patch for bug 3952 with new --foreground option.
   - Ported patch for bug 7 forward.
  - Compile with devtoolset-2-toolchain on el6, in order to use c++11
  - Add PAM basic authentication module
  - Disable security-cert-validators to avoid perl Crypt::OpenSSL:X509
    dependency


author: Dave Dykstra <dwd@fnal.gov> 4.4-1.1
changelog:
  - Upgrade to 4.4-1 tarball with the following release notes:
   - Update to squid-4.4 with release notes at
      https://www.mail-archive.com/squid-announce@lists.squid-cache.org/msg00086.html
     including one fairly significant security fix for a potential denial
     of service due to memory leaks on rejected SNMP queries.
   - If different squid services have different numbers of workers (for
      example by using setserviceoption on "workers") then use the biggest
      number when creating cache and log directories.


author: Dave Dykstra <dwd@fnal.gov> 4.4-2.1
changelog:
  - Upgrade to 4.4-2 tarball with the following release note:
   - Apply security patch for CVE-2019-12527
        http://www.squid-cache.org/Advisories/SQUID-2019_5.txt
      which can (before being patched) be exploited through the ftp protocol.


author: Dave Dykstra <dwd@fnal.gov> 4.6-1.1
changelog:
  - Upgrade to 4.6-1 tarball with the following release notes:
   - Update to squid-4.6 with release notes at
      https://www.mail-archive.com/squid-announce@lists.squid-cache.org/msg00090.html
     squid-4.5 release notes are at
      https://www.mail-archive.com/squid-announce@lists.squid-cache.org/msg00089.html
   - If a rotate is blocked because processing awstats logs is running long,
     do the rotate during the next rotateiflarge cron instead.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.7-1.3
changelog:
  - Complete the fix from 5.7-1.2. An additional work-around was needed
     for the squid-4 to squid-5 upgrade to change a directory that was generating
     yum transaction errors into a link, which silenced the errors.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.8-1.1
changelog:
  - Update to squid-5.8 with release notes at
      https://www.squid-cache.org/Versions/v5/squid-5.8-RELEASENOTES.html and announcement at
      http://lists.squid-cache.org/pipermail/squid-announce/2023-February/000145.html
      Most important new features in 5.8:
      - A predefined ACL named "to_linklocal" which matches traffic attempting to access
       link-local network services has been added. It is set to "deny" in
       squid/files/postinstall/squid.conf.proto.
      - Bug fixed where cache manager API erroneously returns "mgr_index" instead of requested
       data.
   - Add support for rpmbuild on el9
   - Add object-*.cloud to the computecanada portion of MAJOR_CVMFS in
      squid/files/postinstall/squid.conf.proto.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.8-2.1
changelog:
  - For EL9, in this spec file replace calls to obsolete "service" and add new package
     requirements.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.9-1.1
changelog:
  - Update to squid-5.9, with announcement at
      http://lists.squid-cache.org/pipermail/squid-announce/2023-May/000147.html and
      release notes at http://www.squid-cache.org/Versions/v5/squid-5.9-RELEASENOTES.html.
      squid-5.9 contains small fixes including improvement of debug logging related to the
      reply_body_max_size parameter.
   - Consistent with squid5, disallow the combination of multiple workers, ufs cache,
      and memory_cache_shared even if collapsed_forwarding is off.
   - Limit the  maximum number of file descriptors to 65536 even if the OS would allow
      a higher number.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.9-1.2
changelog:
  - With the addtion of an EL9 repository, this release includes an EL9 RPM that was
      compiled on EL9 and that fully supports Web Proxy Auto Discovery. The EL7/EL8
      RPM in this release is unchanged from 5.9-1.1, except for version number.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.9-2.1
changelog:
  - Apply security patches from Squid 6 to address security concerns since 
      a version of Squid 6 suitable for frontier-squid is not available yet.
   - The following security vulnerabilities have been addressed with patches:
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46724
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46847
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46848
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-49285
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-50269
      https://github.com/squid-cache/squid/security/advisories/GHSA-j83v-w3p4-5cqh
   - The following two vulnerabilities are addressed by disabling Gopher and TRACE
      requests, respectively, in the squid.conf.proto file:
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46728
      https://megamansec.github.io/Squid-Security-Audit/trace-uaf.html
   - To support SELinux, require /sbin/restorecon and apply it to the log directory,
      in addition to the cache directory.
   - Update to shoal-1.0.2 to fix setting of external_ip.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.9-3.1
changelog:
  - Upgrade to 5.9-3 tarball with the following release notes:
    - Add *.eessi.science to MAJOR_CVMFS in squid/files/postinstall/squid.conf.proto.
   - Move frontier-squid.sh from /etc/init.d to /usr/libexec/squid. Remove chkconfig
      because it is no longer needed. Move all steps of preparation of the
      frontier-squid-utils prototype files to this file to simplify future
      maintenance.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.9-3.2
changelog:
  - Fix building of RPM to properly choose Python36 or Python39.
       Also, restrict building to x86_64 architecture.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.10-1.1
changelog:
  - Update to squid-5.10, with release notes at
      https://github.com/squid-cache/squid/commits/v5.
      The security patches included in frontier-squid-5.9-2 have been incorporated
      into the baseline Squid code in this release.
      It also contains fixes for minor bugs and these security issues:
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-25617
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-23638
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-37894
      https://megamansec.github.io/Squid-Security-Audit/esi-underflow.html
      https://megamansec.github.io/Squid-Security-Audit/ftp-fatal.html
      https://megamansec.github.io/Squid-Security-Audit/ipv6-assert.html
      https://megamansec.github.io/Squid-Security-Audit/stream-assert.html
   - For SELinux, make frontier-squid script trusted in /usr/libexec/squid to
       prevent log rotation failures.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.7-1.1
changelog:
  - Upgrade to 5.7-1 tarball with the following release notes:
   - Update to squid-5.7 with release notes at https://wiki.squid-cache.org/Squid-5 and
      http://www.squid-cache.org/Versions/v5/RELEASENOTES.html.
      Most important new feature in 5.7:
      - "Happy Eyeballs" feature uses the first destination IP address that responds
         from DNS, whether it is IPv4 (A records) or IPv6 (AAAA records). A consequence
         of this feature is that the dns_v4_first directive is no longer supported.
   - Add sites cvmfs-stratum-one.cc.kek.jp and cvmfs*.sdcc.bnl.gov
      to MAJOR_CVMFS in squid/files/postinstall/squid.conf.proto.
   - Remove obsolete frontier*.racf.bnl.gov from ATLAS_FRONTIER
      in squid/files/postinstall/squid.conf.proto.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.7-1.2
changelog:
  - Add pretrans scriplet to this spec file to fix problem with squid-4 to
     squid-5 upgrade where a link becomes a directory.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.9-3.2
changelog:
  - Fix RPM to properly choose Python36 or Python39 during installation.
       Also, restrict building to x86_64 architecture.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.9-2.1
changelog:
  - Apply security patches from Squid 6 to address security concerns since
      a version of Squid 6 suitable for frontier-squid is not available yet.
   - The following security vulnerabilities have been addressed with patches:
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46724
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46847
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46848
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-49285
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-50269
      https://github.com/squid-cache/squid/security/advisories/GHSA-j83v-w3p4-5cqh
   - The following two vulnerabilities are addressed by disabling Gopher and TRACE
      requests, respectively, in the squid.conf.proto file:
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46728
      https://megamansec.github.io/Squid-Security-Audit/trace-uaf.html
   - To support SELinux, require /sbin/restorecon and apply it to the log directory,
      in addition to the cache directory.
   - Update to shoal-1.0.2 to fix setting of external_ip.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.10-1.1
changelog:
  - Update to squid-5.10, with release notes at
      https://github.com/squid-cache/squid/commits/v5.
      The security patches included in frontier-squid-5.9-2 have been incorporated
      into the baseline Squid code in this release.
      It also contains fixes for minor bugs and these security issues:
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-25617
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-23638
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-37894
      https://megamansec.github.io/Squid-Security-Audit/esi-underflow.html
      https://megamansec.github.io/Squid-Security-Audit/ftp-fatal.html
      https://megamansec.github.io/Squid-Security-Audit/ipv6-assert.html
      https://megamansec.github.io/Squid-Security-Audit/stream-assert.html
   - For SELinux, provide proper labeling for /usr/libexec/squid/frontier-squid
      script to prevent log rotation failures.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 6.13-1.3
changelog:
  - Update to squid-6.13, with announcement at
      https://lists.squid-cache.org/pipermail/squid-announce/2025-February/000167.html
      and release notes at https://github.com/squid-cache/squid/releases/tag/SQUID_6_13
      squid-6 has a number of new features and changes, such as
      - TLS ServerHello
      - Log TLS Communication Secrets
      - Ban ACL key Changes in ACLs
      - Block to-local Traffic
      - RFC 9211: HTTP Cache-Status support
      - RFC 9111: Stop treating Warning specially
      - ext_kerberos_ldap_group_acl: Support -b with -D
      - Remove Gopher Protocol Support
      - Remove Outdated Tools
   - Set "memory_cache_shared on" as work-around for Squid bug 5332:
      https://bugs.squid-cache.org/show_bug.cgi?id=5332
   - Require Rock cache when workers > 1.  NOTE: This is a breaking change for
      installations with multiple workers, but necessary because of the work-around
      for bug 5332.
   - Set "request_header_access If-Modified-Since deny all" when Rock cache is used to
      avoid Squid bug 4890: https://bugs.squid-cache.org/show_bug.cgi?id=4890
   - Add patch to fix reporting of number of cache objects.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 6.13-1.3
changelog:
  - Upgrade to 6.13-1 tarball with announcement at
     https://lists.squid-cache.org/pipermail/squid-announce/2025-February/000167.html
     and release notes at https://github.com/squid-cache/squid/releases/tag/SQUID_6_13
     squid-6 has a number of new features and changes, such as
      - TLS ServerHello
      - Log TLS Communication Secrets
      - Ban ACL key Changes in ACLs
      - Block to-local Traffic
      - RFC 9211: HTTP Cache-Status support
      - RFC 9111: Stop treating Warning specially
      - ext_kerberos_ldap_group_acl: Support -b with -D
      - Remove Gopher Protocol Support
      - Remove Outdated Tools
   - Set "memory_cache_shared on" as work-around for Squid bug 5332:
      https://bugs.squid-cache.org/show_bug.cgi?id=5332
   - Require Rock cache when workers > 1.  NOTE: This is a breaking change for
      installations with multiple workers, but necessary because of the work-around
      for bug 5332.
   - Set "request_header_access If-Modified-Since deny all" when Rock cache is used to
      avoid Squid bug 4890: https://bugs.squid-cache.org/show_bug.cgi?id=4890
   - Add patch to fix reporting of number of cache objects.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 6.14-1.1
changelog:
  - Upgrade to 6.14-1 tarball with the following release notes:
     https://github.com/squid-cache/squid/releases/tag/SQUID_6_14
   - Add an "ignore_vary" option to prevent Vary headers (like those from
      Cloudflare) from interfering with caching in Rock cache, and enable
      that option by default.
   - Add a default value of "shared_transient_entries_limit 1048576" to
      reduce the chances of clashing hashes of queries while using
      multiple workers.  A clashing hash causes a query to not be cached.
      This increased value could use up to 128MB of shared memory.
   - Restored text of error messages that appear in rare cases and that were
      missing from the previous release.
   - Improved checks for cache memory configuration to allow multiple services to
      have their own cache memory values and to prevent reduction in configured
      cache memory during re-starts. Also, increased safety buffer of shared memory from
      10% to 20%.
   - Addressed security vulnerability SQUID-2025:2 Information Disclosure in Error handling:
      https://github.com/squid-cache/squid/security/advisories/GHSA-c8cc-phh7-xmxr
   - Removed obsolete in2p3, gridpp, and triumf from "acl ATLAS_FRONTIER".
   - Add a patch from v7 to avoid a "slot->sameKey()" assertion error in
      rock/RockSwapDir.cc that has been seen with multiple workers and
      causes one worker to restart and prevent a query from being cached
      until a full restart.
   - Remove cachenumfix.patch because it is now part of Squid 6.14.
  - Add support for EL10.
  - Disable admin emails from shoal-agent.
  - Changed pip3 install of obsolete Python module "netifaces" to new "netifaces-plus" to
     enable shoal-agent to run on EL10.
  - Fixed setting permissions of shoal-download directories to prevent "Permission denied"
     errors.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 6.14-1.2
changelog:
  - During build of source RPM, download additional Python modules "cffi" and
     "typing_extensions" to support building EL9 and EL10 from source RPM on OSG
     build machines where downloading is disabled.
  - Correct location of "shoal_email.patch".


author: Dave Dykstra <dwd@fnal.gov> - 0.2-1
changelog:
  - Add initial implementation of wlcg-wpad.cern.ch
  - Copy config files from wlcg-squid-monitor.cern.ch
  - Rename apache config to 10-wlcg-wpad.conf to give it order priority


author: Dave Dykstra <dwd@fnal.gov> - 0.4-1
changelog:
  - Disable the entries that are marked "disabled"
  - When there's a match, print "// For sitename, ..." as a leading comment


author: Dave Dykstra <dwd@fnal.gov> - 0.5-1
changelog:
  - Add support for client load balancing of proxies
  - If "cmsnames" is present in the data, add those to the first line comment
    in the form "; CMS: sitename,..."


author: Dave Dykstra <dwd@fnal.gov> - 0.6-1
changelog:
  - Return specific error messages from wlcg_wpad module to the user
    rather than a generic "No proxy found"


author: Dave Dykstra <dwd@fnal.gov> - 0.7-1
changelog:
  - Change config file name from geosort.conf to wlcgwpad.conf
  - Add support for destshexps config variable, which are shortcuts to shell
    expressions that choose different proxy services
  - Add support for ipranges keyword in input file, to limit a proxy service
    to a subrange of source addresses
  - Use ip address passed in from input file instead of looking names up
    in the DNS


author: Dave Dykstra <dwd@fnal.gov> - 1.0-1
changelog:
  - Add support for destination aliases in hostproxies
  - Add support for DIRECT proxy
  - Change WSGI config to be like the latest cvmfs-server


author: Dave Dykstra <dwd@fnal.gov> - 1.1-1
changelog:
  - Re-read wlcgpad.conf if it changes.  Check every 5 minutes, just like
    worker-proxy.json already was.


author: Dave Dykstra <dwd@fnal.gov> - 1.1-1
changelog:
  - Re-read wlcgpad.conf if it changes.  Check every 5 minutes, just like
    worker-proxies.json already was.


author: Dave Dykstra <dwd@fnal.gov> - 1.2-1
changelog:
  - Lock the updates of reading config files, so only one thread ever does it.
  - Remove tabs from source files.


author: Dave Dykstra <dwd@fnal.gov> - 1.3-1
changelog:
  - Update worker proxies from scratch instead of modifying in place.  This
    enables removed sites to be deleted.
  - Update configuration and worker proxies in separate space so the updates
    are atomic to other threads.


author: Dave Dykstra <dwd@fnal.gov> 1.6-1
changelog:
  - If no proxies are specified in hostproxies after a destination alias,
    make the response return NONE as a default.  That causes frontier to
    give a fatal error if it hits the case, which is what I want, but
    cvmfs skips past it (although it logs some nasty-looking error
    messages).  Cvmfs will not connect to the server however without a
    DIRECT proxy so it will still fail too.


author: Dave Dykstra <dwd@fnal.gov> 1.9-1
changelog:
  - Add support for unquoting the ? parameter.  This is so an '=' can be
    hidden from the frontier client with %3d.


author: Dave Dykstra <dwd@fnal.gov> 1.10-1
changelog:
  - Add support for the OVERLOAD special proxy selection function and the
    overload excludes option.
  - Fix the locks on reading worker-proxies.json and wlcgwpad.conf.
  - Update to GeoIP2 databases, require cvmfs-server >= 2.5.1


author: Dave Dykstra <dwd@fnal.gov> 1.12-1
changelog:
  - Add support for shoal-registered squids
  - Update squid info files every 5 minutes instead of every 20
  - Restore the beginning comment indicating the name of the site


author: Dave Dykstra <dwd@fnal.gov> 1.13-1
changelog:
  - Add support for /fsad.conf requests, for frontier-squid auto discovery
    configuration
  - Make other threads wait while data is read for the first time
  - Add /usr/share/wlcg-wpad/wlcgwpad.conf.template for the documentation


author: Dave Dykstra <dwd@fnal.gov> 1.15-1
changelog:
  - Add support for stashservers.dat
  - Improve response when a hostproxies ends in an OVERLOAD option and
      no WLCG squid is found to return bad request 'no squid found'
      instead of 'no proxy addr in database'


author: Dave Dykstra <dwd@fnal.gov> 1.18-1
changelog:
  - Treat a found empty squid list the same as no match.  This is for
    excluding ipranges from those served by squids.


author: Edita Kizinevic <edita.kizinevic@cern.ch> 1.20-1
changelog:
  - Add IPv6 support.
  - Add organizations cache.
  - Use 'ips' keyword in worker-proxies.json instead of 'ip'.


author: Edita Kizinevic <edita.kizinevic@cern.ch> 1.23-1
changelog:
  - Always update the geodb every week instead of using lazy update,
    causing it update only every 4 weeks.
  - Expose /cvmfs/info/v1/repositories.json to http.


author: Dave Dykstra <dwd@fnal.gov> 1.6-1
changelog:
  - If no proxies are specified in hostproxies after a destination alias,
    make the response return NONE as a default.  That causes frontier to
    give a fatal error if it hits the case, which is what I want, but cvmfs
    skips past it.  I believe that cvmfs will not connect to the server
    however without a DIRECT proxy so it should still fail too.


