.gitignore

@@ -1,25 +1,22 @@
 SOURCES/HAM-logo.png
-SOURCES/backports-3.17.2.gem
+SOURCES/backports-3.24.1.gem
-SOURCES/dacite-1.6.0.tar.gz
+SOURCES/dacite-1.8.1.tar.gz
-SOURCES/daemons-1.3.1.gem
 SOURCES/dataclasses-0.8.tar.gz
-SOURCES/ethon-0.12.0.gem
+SOURCES/ethon-0.16.0.gem
-SOURCES/eventmachine-1.2.7.gem
+SOURCES/ffi-1.16.3.gem
-SOURCES/ffi-1.13.1.gem
+SOURCES/json-2.6.3.gem
-SOURCES/json-2.3.0.gem
+SOURCES/mustermann-2.0.2.gem
-SOURCES/mustermann-1.1.1.gem
+SOURCES/nio4r-2.5.9.gem
 SOURCES/open4-1.3.4-1.gem
-SOURCES/pcs-0.10.8.181-47e9.tar.gz
+SOURCES/pcs-0.10.18.tar.gz
-SOURCES/pcs-web-ui-0.1.6.tar.gz
+SOURCES/puma-6.4.0.gem
-SOURCES/pcs-web-ui-node-modules-0.1.6.tar.xz
 SOURCES/pyagentx-0.4.pcs.2.tar.gz
-SOURCES/python-dateutil-2.8.1.tar.gz
+SOURCES/python-dateutil-2.8.2.tar.gz
-SOURCES/rack-2.2.3.gem
+SOURCES/rack-2.2.16.gem
-SOURCES/rack-protection-2.0.8.1.gem
+SOURCES/rack-protection-2.2.4.gem
-SOURCES/rack-test-1.1.0.gem
+SOURCES/rack-test-2.1.0.gem
-SOURCES/rexml-3.2.5.gem
+SOURCES/rexml-3.4.1.gem
-SOURCES/ruby2_keywords-0.0.2.gem
+SOURCES/ruby2_keywords-0.0.5.gem
-SOURCES/sinatra-2.0.8.1.gem
+SOURCES/sinatra-2.2.4.gem
-SOURCES/thin-1.7.2.gem
+SOURCES/tilt-2.3.0.gem
-SOURCES/tilt-2.0.10.gem
+SOURCES/tornado-6.1.0.pcs.2.tar.gz
-SOURCES/tornado-6.1.0.tar.gz

.pcs.metadata

@@ -1,25 +1,22 @@
 679a4ce22a33ffd4d704261a17c00cff98d9499a SOURCES/HAM-logo.png
-28b63a742124da6c9575a1c5e7d7331ef93600b2 SOURCES/backports-3.17.2.gem
+0ef72a288913e220695ad62718aeb75171924028 SOURCES/backports-3.24.1.gem
-31546c37fbdc6270d5097687619e9c0db6f1c05c SOURCES/dacite-1.6.0.tar.gz
+07b26abbf7ff0dcba5c7f9e814ff7eebafefb058 SOURCES/dacite-1.8.1.tar.gz
-e28c1e78d1a6e34e80f4933b494f1e0501939dd3 SOURCES/daemons-1.3.1.gem
 8b7598273d2ae6dad2b88466aefac55071a41926 SOURCES/dataclasses-0.8.tar.gz
-921ef1be44583a7644ee7f20fe5f26f21d018a04 SOURCES/ethon-0.12.0.gem
+5b56a68268708c474bef04550639ded3add5e946 SOURCES/ethon-0.16.0.gem
-7a5b2896e210fac9759c786ee4510f265f75b481 SOURCES/eventmachine-1.2.7.gem
+10e4cf0e11ef4581ec4ad5fe2cdf3c78b6077d39 SOURCES/ffi-1.16.3.gem
-cfa25e7a3760c3ec16723cb8263d9b7a52d0eadf SOURCES/ffi-1.13.1.gem
+6d78f730b7f3b25fb3f93684fe1364acf58bce6b SOURCES/json-2.6.3.gem
-0230e8c5a37f1543982e5b04be503dd5f9004b47 SOURCES/json-2.3.0.gem
+f5f804366823c1126791dfefd98dd0539563785c SOURCES/mustermann-2.0.2.gem
-50a4e37904485810cb05e27d75c9783e5a8f3402 SOURCES/mustermann-1.1.1.gem
+2f65d371f5f37460ad74afcedcb97d2b41a46806 SOURCES/nio4r-2.5.9.gem
 41a7fe9f8e3e02da5ae76c821b89c5b376a97746 SOURCES/open4-1.3.4-1.gem
-cda150aa3e2e5b5c84ec4f462914e167c6a2526c SOURCES/pcs-0.10.8.181-47e9.tar.gz
+b3cd873042b17021355b68f1f7aa313f0c1f3fee SOURCES/pcs-0.10.18.tar.gz
-0d5a8c5f3c2888e19de1f7180401bbfcfd423e24 SOURCES/pcs-web-ui-0.1.6.tar.gz
+d6049c4555f3c9d198e6eb1d7e53ce9b68e175ff SOURCES/puma-6.4.0.gem
-3d401b7048e51cb097c3b55c77492e76dde1d443 SOURCES/pcs-web-ui-node-modules-0.1.6.tar.xz
 3176b2f2b332c2b6bf79fe882e83feecf3d3f011 SOURCES/pyagentx-0.4.pcs.2.tar.gz
-bd26127e57f83a10f656b62c46524c15aeb844dd SOURCES/python-dateutil-2.8.1.tar.gz
+c2ba10c775b7a52a4b57cac4d4110a0c0f812a82 SOURCES/python-dateutil-2.8.2.tar.gz
-345b7169d4d2d62176a225510399963bad62b68f SOURCES/rack-2.2.3.gem
+807c69f4ebada58686cee22884623063745007c2 SOURCES/rack-2.2.16.gem
-1f046e23baca8beece3b38c60382f44aa2b2cb41 SOURCES/rack-protection-2.0.8.1.gem
+5347315a7283f0b04443e924ed4eaa17807432c8 SOURCES/rack-protection-2.2.4.gem
-b80bc5ca38a885e747271675ba91dd3d02136bf1 SOURCES/rack-test-1.1.0.gem
+ae09ea83748b55875edc3708fffba90db180cb8e SOURCES/rack-test-2.1.0.gem
-e7f48fa5fb2d92e6cb21d6b1638fe41a5a7c4287 SOURCES/rexml-3.2.5.gem
+966b1564a77719483eb61068ed1dfb638e5e8eb0 SOURCES/rexml-3.4.1.gem
-0be571aacb5d6a212a30af3f322a7000d8af1ef9 SOURCES/ruby2_keywords-0.0.2.gem
+d017b9e4d1978e0b3ccc3e2a31493809e4693cd3 SOURCES/ruby2_keywords-0.0.5.gem
-04cca7a5d9d641fe076e4e24dc5b6ff31922f4c3 SOURCES/sinatra-2.0.8.1.gem
+fa6a6c98f885e93f54c23dd0454cae906e82c31b SOURCES/sinatra-2.2.4.gem
-41395e86322ffd31f3a7aef1f697bda3e1e2d6b9 SOURCES/thin-1.7.2.gem
+4a38a9a55887b2882182a2c5771e592efe514e5e SOURCES/tilt-2.3.0.gem
-d265c822a6b228392d899e9eb5114613d65e6967 SOURCES/tilt-2.0.10.gem
+3e0fc1e17c45a8e25bdd6ade8dbbc522f64f2ae1 SOURCES/tornado-6.1.0.pcs.2.tar.gz
-c23c617c7a0205e465bebad5b8cdf289ae8402a2 SOURCES/tornado-6.1.0.tar.gz

SOURCES/RHEL-17280-01-disable-new-webui-routes.patch

@@ -0,0 +1,55 @@
+From 957856a556f5ed92129ce602538c3df3aebce7a3 Mon Sep 17 00:00:00 2001
+From: Ivan Devat <idevat@redhat.com>
+Date: Tue, 5 Dec 2023 15:18:35 +0100
+Subject: [PATCH 2/2] disable alternative webui routes
+
+This commit is intended to be downstream only.
+
+The new web ui was part of rhel8 as a technical preview. But new web ui
+is now the main in rhel9 and there is no need to keep it in rhel8.
+To prevent unnecessary maintenance burden it is disabled now.
+No handler code is removed, just routing disabled.
+---
+ pcs/daemon/run.py | 26 ++++++++++++++++----------
+ 1 file changed, 16 insertions(+), 10 deletions(-)
+
+diff --git a/pcs/daemon/run.py b/pcs/daemon/run.py
+index 7fdeda2a..0a6b1b21 100644
+--- a/pcs/daemon/run.py
++++ b/pcs/daemon/run.py
+@@ -81,16 +81,22 @@ def configure_app(
+             routes.extend(
+                 # old web ui by default
+                 [(r"/", RedirectHandler, dict(url="/manage"))]
+-                + [(r"/ui", RedirectHandler, dict(url="/ui/"))]
+-                + ui.get_routes(
+-                    url_prefix="/ui/",
+-                    app_dir=os.path.join(public_dir, "ui"),
+-                    fallback_page_path=os.path.join(
+-                        public_dir,
+-                        "ui_instructions.html",
+-                    ),
+-                    session_storage=session_storage,
+-                )
++                # The following disabled routes was for the new web ui. The new
++                # web ui was here as a technical preview. But new web ui is now
++                # the main in rhel9 and there is no need to keep it in rhel8.
++                # To prevent unnecessary maintenance burden it is disabled now.
++                # No handler code is removed, just routing disabled.
++                #
++                # + [(r"/ui", RedirectHandler, dict(url="/ui/"))]
++                # + ui.get_routes(
++                #     url_prefix="/ui/",
++                #     app_dir=os.path.join(public_dir, "ui"),
++                #     fallback_page_path=os.path.join(
++                #         public_dir,
++                #         "ui_instructions.html",
++                #     ),
++                #     session_storage=session_storage,
++                # )
+                 + sinatra_ui.get_routes(
+                     session_storage, ruby_pcsd_wrapper, public_dir
+                 )
+-- 
+2.43.0
+

SOURCES/RHEL-65595-stop-sending-http-headers-to-ruby-part-of-pcsd.patch

@@ -0,0 +1,52 @@
+From 6142961fe0e39bdbba0d70f792fc27fb2bc096ba Mon Sep 17 00:00:00 2001
+From: Ivan Devat <idevat@redhat.com>
+Date: Thu, 7 Mar 2024 16:51:13 +0100
+Subject: [PATCH] stop sending http headers to ruby part of pcsd
+
+---
+ pcs/daemon/ruby_pcsd.py | 23 ++++++++++++++++++++++-
+ 1 file changed, 22 insertions(+), 1 deletion(-)
+
+diff --git a/pcs/daemon/ruby_pcsd.py b/pcs/daemon/ruby_pcsd.py
+index 4b3b0ea1..e07e17cc 100644
+--- a/pcs/daemon/ruby_pcsd.py
++++ b/pcs/daemon/ruby_pcsd.py
+@@ -87,13 +87,34 @@ class RubyDaemonRequest(
+         http_request: HTTPServerRequest = None,
+         payload=None,
+     ):
+-        headers = http_request.headers if http_request else HTTPHeaders()
++        # Headers from request are not propagated to ruby part. Ruby part doesn't
++        # work with standard headers in any special way. So, we send only path,
++        # method, query, body and special headers for communication between
++        # python part and ruby part. Tornado then adds necessary default
++        # headers. The motivation here is to prevent processing potentially
++        # maliciously crafted headers by rack.
++        headers = HTTPHeaders()
+         headers.add("X-Pcsd-Type", request_type)
+         if payload:
+             headers.add(
+                 "X-Pcsd-Payload",
+                 b64encode(json.dumps(payload).encode()).decode(),
+             )
++        if http_request:
++            for key, val in http_request.headers.get_all():
++                # From webui, POST request can come with either
++                # application/x-www-form-urlencoded or application/json content
++                # type. When we remove original HTTP headers, content type is
++                # added by tornado. But in the case of original application/json,
++                # tornado puts application/x-www-form-urlencoded there. To fix
++                # this let's keep the original header here in this case.
++                #
++                # The token, CIB_user and CIB_user_groups are transferred by the
++                # "Cookie" header and these information are evaluated in ruby.
++                if (
++                    key.lower() == "content-type" and val == "application/json"
++                ) or key.lower() == "cookie":
++                    headers.add(key, val)
+         return super(RubyDaemonRequest, cls).__new__(
+             cls,
+             request_type,
+-- 
+2.47.0
+

SOURCES/RHEL-90147-support-for-query-limits-in-rack.patch

@@ -0,0 +1,45 @@
+From 0ad47ec40b7a9a2cb6bdbdf11e1e5b3c59f49b8b Mon Sep 17 00:00:00 2001
+From: Miroslav Lisik <mlisik@redhat.com>
+Date: Tue, 20 May 2025 16:34:18 +0200
+Subject: [PATCH] support for query limits in rack
+
+---
+ pcsd/conf/pcsd | 6 ++++++
+ pcsd/pcsd.rb   | 5 +++++
+ 2 files changed, 11 insertions(+)
+
+diff --git a/pcsd/conf/pcsd b/pcsd/conf/pcsd
+index 98df4744..65a9c9a9 100644
+--- a/pcsd/conf/pcsd
++++ b/pcsd/conf/pcsd
+@@ -45,5 +45,11 @@ PCSD_SESSION_LIFETIME=3600
+ # is 50 (even if set lower).
+ PCSD_RESTART_AFTER_REQUESTS=200
+ 
++# These environment variables set the maximum query string bytesize and the
++# maximum number of query parameters that pcsd will attempt to parse.
++# See CVE-2025-46727 for details.
++#RACK_QUERY_PARSER_BYTESIZE_LIMIT=4194304
++#RACK_QUERY_PARSER_PARAMS_LIMIT=4096
++
+ # Do not change
+ RACK_ENV=production
+diff --git a/pcsd/pcsd.rb b/pcsd/pcsd.rb
+index 11698f54..a2634e4e 100644
+--- a/pcsd/pcsd.rb
++++ b/pcsd/pcsd.rb
+@@ -90,6 +90,11 @@ configure do
+   CAPABILITIES_PCSD = capabilities_pcsd.freeze
+ end
+ 
++error Rack::QueryParser::QueryLimitError do
++  $logger.warn(env['sinatra.error'].message)
++  return 400, env['sinatra.error'].message
++end
++
+ def run_cfgsync
+   node_connected = true
+   if Cfgsync::ConfigSyncControl.sync_thread_allowed?()
+-- 
+2.49.0
+

SOURCES/do-not-support-cluster-setup-with-udp-u-transport.patch

@@ -1,7 +1,7 @@
-From 34df297266fb33d2cc062f2a5a584183a450d763 Mon Sep 17 00:00:00 2001
+From 854efcf148c82e5a5e4f0afd71cc3333ea4a8ce4 Mon Sep 17 00:00:00 2001
 From: Ivan Devat <idevat@redhat.com>
 Date: Tue, 20 Nov 2018 15:03:56 +0100
-Subject: [PATCH 2/2] do not support cluster setup with udp(u) transport
+Subject: [PATCH 1/2] do not support cluster setup with udp(u) transport
 
 ---
  pcs/pcs.8.in              | 2 ++
@@ -10,10 +10,10 @@ Subject: [PATCH 2/2] do not support cluster setup with udp(u) transport
  3 files changed, 6 insertions(+)
 
 diff --git a/pcs/pcs.8.in b/pcs/pcs.8.in
-index 205fdc4e..dfa7f1ea 100644
+index d504e8b4..93202d05 100644
 --- a/pcs/pcs.8.in
 +++ b/pcs/pcs.8.in
-@@ -420,6 +420,8 @@ By default, encryption is enabled with cipher=aes256 and hash=sha256. To disable
+@@ -438,6 +438,8 @@ By default, encryption is enabled with cipher=aes256 and hash=sha256. To disable
  
  Transports udp and udpu:
  .br
@@ -23,10 +23,10 @@ index 205fdc4e..dfa7f1ea 100644
  .br
  Transport options are: ip_version, netmtu
 diff --git a/pcs/usage.py b/pcs/usage.py
-index cec99ef2..30515ebb 100644
+index f4b84202..ee10370a 100644
 --- a/pcs/usage.py
 +++ b/pcs/usage.py
-@@ -853,6 +853,7 @@ Commands:
+@@ -1038,6 +1038,7 @@ Commands:
              hash=sha256. To disable encryption, set cipher=none and hash=none.
  
          Transports udp and udpu:
@@ -49,5 +49,5 @@ index 2f26e831..a7702ac4 100644
  #csetup-transport-options.knet .without-knet
  {
 -- 
-2.31.1
+2.43.0
 

SOURCES/fix-wrong-name-for-library-command.patch

@@ -1,151 +0,0 @@
-From 79570d1d344de985e40602d373eebcf6e94b83d9 Mon Sep 17 00:00:00 2001
-From: Ivan Devat <idevat@redhat.com>
-Date: Thu, 10 Jun 2021 14:52:15 +0200
-Subject: [PATCH 1/2] fix wrong name for library command
-
----
- pcs/cli/common/lib_wrapper.py                        | 8 ++++----
- pcs/cli/constraint_colocation/command.py             | 2 +-
- pcs/cli/constraint_order/command.py                  | 4 +++-
- pcs/cli/constraint_ticket/command.py                 | 4 ++--
- pcs_test/tier0/cli/common/test_lib_wrapper.py        | 6 +++---
- pcs_test/tier0/cli/constraint_ticket/test_command.py | 8 ++++----
- 6 files changed, 17 insertions(+), 15 deletions(-)
-
-diff --git a/pcs/cli/common/lib_wrapper.py b/pcs/cli/common/lib_wrapper.py
-index d9a6bd26..c41ce875 100644
---- a/pcs/cli/common/lib_wrapper.py
-+++ b/pcs/cli/common/lib_wrapper.py
-@@ -230,7 +230,7 @@ def load_module(env, middleware_factory, name):
-             env,
-             middleware.build(middleware_factory.cib),
-             {
--                "set": constraint_colocation.create_with_set,
-+                "create_with_set": constraint_colocation.create_with_set,
-                 "show": constraint_colocation.show,
-             },
-         )
-@@ -240,7 +240,7 @@ def load_module(env, middleware_factory, name):
-             env,
-             middleware.build(middleware_factory.cib),
-             {
--                "set": constraint_order.create_with_set,
-+                "create_with_set": constraint_order.create_with_set,
-                 "show": constraint_order.show,
-             },
-         )
-@@ -250,9 +250,9 @@ def load_module(env, middleware_factory, name):
-             env,
-             middleware.build(middleware_factory.cib),
-             {
--                "set": constraint_ticket.create_with_set,
-+                "create_with_set": constraint_ticket.create_with_set,
-                 "show": constraint_ticket.show,
--                "add": constraint_ticket.create,
-+                "create": constraint_ticket.create,
-                 "remove": constraint_ticket.remove,
-             },
-         )
-diff --git a/pcs/cli/constraint_colocation/command.py b/pcs/cli/constraint_colocation/command.py
-index f5cf91ab..10539aa6 100644
---- a/pcs/cli/constraint_colocation/command.py
-+++ b/pcs/cli/constraint_colocation/command.py
-@@ -18,7 +18,7 @@ def create_with_set(lib, argv, modifiers):
-     """
-     modifiers.ensure_only_supported("-f", "--force")
-     command.create_with_set(
--        lib.constraint_colocation.set,
-+        lib.constraint_colocation.create_with_set,
-         argv,
-         modifiers,
-     )
-diff --git a/pcs/cli/constraint_order/command.py b/pcs/cli/constraint_order/command.py
-index 04a49c8e..7251a4a7 100644
---- a/pcs/cli/constraint_order/command.py
-+++ b/pcs/cli/constraint_order/command.py
-@@ -17,7 +17,9 @@ def create_with_set(lib, argv, modifiers):
-       * -f - CIB file
-     """
-     modifiers.ensure_only_supported("--force", "-f")
--    command.create_with_set(lib.constraint_order.set, argv, modifiers)
-+    command.create_with_set(
-+        lib.constraint_order.create_with_set, argv, modifiers
-+    )
- 
- 
- def show(lib, argv, modifiers):
-diff --git a/pcs/cli/constraint_ticket/command.py b/pcs/cli/constraint_ticket/command.py
-index 7823981e..b4cd2bcd 100644
---- a/pcs/cli/constraint_ticket/command.py
-+++ b/pcs/cli/constraint_ticket/command.py
-@@ -20,7 +20,7 @@ def create_with_set(lib, argv, modifiers):
-     """
-     modifiers.ensure_only_supported("--force", "-f")
-     command.create_with_set(
--        lib.constraint_ticket.set,
-+        lib.constraint_ticket.create_with_set,
-         argv,
-         modifiers,
-     )
-@@ -50,7 +50,7 @@ def add(lib, argv, modifiers):
-     if resource_role:
-         options["rsc-role"] = resource_role
- 
--    lib.constraint_ticket.add(
-+    lib.constraint_ticket.create(
-         ticket,
-         resource_id,
-         options,
-diff --git a/pcs_test/tier0/cli/common/test_lib_wrapper.py b/pcs_test/tier0/cli/common/test_lib_wrapper.py
-index 3a8188c6..33538685 100644
---- a/pcs_test/tier0/cli/common/test_lib_wrapper.py
-+++ b/pcs_test/tier0/cli/common/test_lib_wrapper.py
-@@ -25,8 +25,8 @@ class LibraryWrapperTest(TestCase):
-         mock_middleware_factory.cib = dummy_middleware
-         mock_middleware_factory.corosync_conf_existing = dummy_middleware
-         mock_env = mock.MagicMock()
--        Library(mock_env, mock_middleware_factory).constraint_order.set(
--            "first", second="third"
--        )
-+        Library(
-+            mock_env, mock_middleware_factory
-+        ).constraint_order.create_with_set("first", second="third")
- 
-         mock_order_set.assert_called_once_with(lib_env, "first", second="third")
-diff --git a/pcs_test/tier0/cli/constraint_ticket/test_command.py b/pcs_test/tier0/cli/constraint_ticket/test_command.py
-index 118bfa22..ca4835c3 100644
---- a/pcs_test/tier0/cli/constraint_ticket/test_command.py
-+++ b/pcs_test/tier0/cli/constraint_ticket/test_command.py
-@@ -24,12 +24,12 @@ class AddTest(TestCase):
-         )
-         lib = mock.MagicMock()
-         lib.constraint_ticket = mock.MagicMock()
--        lib.constraint_ticket.add = mock.MagicMock()
-+        lib.constraint_ticket.create = mock.MagicMock()
- 
-         command.add(lib, ["argv"], _modifiers())
- 
-         mock_parse_add.assert_called_once_with(["argv"])
--        lib.constraint_ticket.add.assert_called_once_with(
-+        lib.constraint_ticket.create.assert_called_once_with(
-             "ticket",
-             "resource_id",
-             {"loss-policy": "fence"},
-@@ -60,12 +60,12 @@ class AddTest(TestCase):
-         )
-         lib = mock.MagicMock()
-         lib.constraint_ticket = mock.MagicMock()
--        lib.constraint_ticket.add = mock.MagicMock()
-+        lib.constraint_ticket.create = mock.MagicMock()
- 
-         command.add(lib, ["argv"], _modifiers())
- 
-         mock_parse_add.assert_called_once_with(["argv"])
--        lib.constraint_ticket.add.assert_called_once_with(
-+        lib.constraint_ticket.create.assert_called_once_with(
-             "ticket",
-             "resource_id",
-             {"loss-policy": "fence", "rsc-role": "resource_role"},
--- 
-2.31.1
-

SPECS/pcs.spec

@@ -1,57 +1,51 @@
 Name: pcs
-Version: 0.10.8
+Version: 0.10.18
-Release: 2%{?dist}
+Release: 2%{?dist}.6
 # https://docs.fedoraproject.org/en-US/packaging-guidelines/LicensingGuidelines/
 # https://fedoraproject.org/wiki/Licensing:Main?rd=Licensing#Good_Licenses
-# GPLv2: pcs
+# GPL-2.0-only: pcs
-# ASL 2.0: dataclasses, tornado
+# Apache-2.0: dataclasses, tornado
-# ASL 2.0 or BSD: dateutil
+# Apache-2.0 or BSD-3-Clause: dateutil
-# MIT: backports, dacite, daemons, ember, ethon, handlebars, jquery, jquery-ui,
+# MIT: backports, dacite, ember, ethon, handlebars, jquery, jquery-ui,
 #      mustermann, rack, rack-protection, rack-test, sinatra, tilt
-# GPLv2 or Ruby: eventmachne, json
+# MIT and (BSD-2-Clause or GPL-2.0-or-later): nio4r
-# (GPLv2 or Ruby) and BSD: thin
+# GPL-2.0-only or Ruby: json
-# BSD or Ruby: open4, ruby2_keywords
+# BSD-2-Clause or Ruby: open4, ruby2_keywords
-# BSD and MIT: ffi
+# BSD-3-Clause: puma
-License: GPLv2 and ASL 2.0 and MIT and BSD and (GPLv2 or Ruby) and (BSD or Ruby) and (ASL 2.0 or BSD).
+# BSD-3-Clause and MIT: ffi
+License: GPL-2.0-only AND Apache-2.0 AND MIT AND BSD-3-Clause AND (Apache-2.0 OR BSD-3-Clause) AND (BSD-2-Clause OR Ruby) AND (BSD-2-Clause OR GPL-2.0-or-later) AND (GPL-2.0-only or Ruby)
 URL: https://github.com/ClusterLabs/pcs
 Group: System Environment/Base
-Summary: Pacemaker Configuration System
+Summary: Pacemaker/Corosync Configuration System
 #building only for architectures with pacemaker and corosync available
 ExclusiveArch: i686 x86_64 s390x ppc64le aarch64
 
-# %%global version_or_commit %%{version}
+# When specifying a commit, use its long hash
-%global version_or_commit %{version}.181-47e9
+%global version_or_commit %{version}
-
+# %%global version_or_commit 1fa11fa39029896939a5545968ed60ede714b992
 %global pcs_source_name %{name}-%{version_or_commit}
 
-# ui_commit can be determined by hash, tag or branch
-%global ui_commit 0.1.6
-%global ui_modules_version 0.1.6
-%global ui_src_name pcs-web-ui-%{ui_commit}
-
 %global pcs_snmp_pkg_name  pcs-snmp
 
 %global pyagentx_version   0.4.pcs.2
-%global tornado_version    6.1.0
 %global dataclasses_version 0.8
-%global dacite_version  1.6.0
+%global dacite_version  1.8.1
-%global dateutil_version  2.8.1
+%global dateutil_version  2.8.2
-%global version_rubygem_backports  3.17.2
+%global version_rubygem_backports  3.24.1
-%global version_rubygem_daemons  1.3.1
+%global version_rubygem_ethon  0.16.0
-%global version_rubygem_ethon  0.12.0
+%global version_rubygem_ffi  1.16.3
-%global version_rubygem_eventmachine  1.2.7
+%global version_rubygem_json  2.6.3
-%global version_rubygem_ffi  1.13.1
+%global version_rubygem_mustermann  2.0.2
-%global version_rubygem_json  2.3.0
+%global version_rubygem_nio4r 2.5.9
-%global version_rubygem_mustermann  1.1.1
 %global version_rubygem_open4  1.3.4
-%global version_rubygem_rack  2.2.3
+%global version_rubygem_puma 6.4.0
-%global version_rubygem_rack_protection  2.0.8.1
+%global version_rubygem_rack  2.2.16
-%global version_rubygem_rack_test  1.1.0
+%global version_rubygem_rack_protection  2.2.4
-%global version_rubygem_rexml  3.2.5
+%global version_rubygem_rack_test  2.1.0
-%global version_rubygem_ruby2_keywords  0.0.2
+%global version_rubygem_rexml  3.4.1
-%global version_rubygem_sinatra  2.0.8.1
+%global version_rubygem_ruby2_keywords  0.0.5
-%global version_rubygem_thin  1.7.2
+%global version_rubygem_sinatra  2.2.4
-%global version_rubygem_tilt  2.0.10
+%global version_rubygem_tilt  2.3.0
 
 # javascript bundled libraries for old web-ui
 %global ember_version 1.4.0
@@ -59,6 +53,10 @@ ExclusiveArch: i686 x86_64 s390x ppc64le aarch64
 %global jquery_ui_version 1.12.1
 %global jquery_version 3.6.0
 
+# DO NOT UPDATE
+# Tornado 6.2 requires Python 3.7+
+%global tornado_version    6.1.0.pcs.2
+
 %global pcs_bundled_dir pcs_bundled
 %global pcsd_public_dir pcsd/public
 %global rubygem_bundle_dir pcsd/vendor/bundle
@@ -79,14 +77,20 @@ ExclusiveArch: i686 x86_64 s390x ppc64le aarch64
 #    /usr/bin/python will be removed or switched to Python 3 in the future.
 %global __python %{__python3}
 
-Source0: %{url}/archive/%{version_or_commit}/%{pcs_source_name}.tar.gz
+# prepend v for folder in GitHub link when using tagged tarball
+%if "%{version}" == "%{version_or_commit}"
+  %global v_prefix v
+%endif
+
+# part after the last slash is recognized as filename in look-aside cache
+Source0: %{url}/archive/%{?v_prefix}%{version_or_commit}/%{pcs_source_name}.tar.gz
 Source1: HAM-logo.png
 
 Source41: https://github.com/ondrejmular/pyagentx/archive/v%{pyagentx_version}/pyagentx-%{pyagentx_version}.tar.gz
-Source42: https://github.com/tornadoweb/tornado/archive/v%{tornado_version}/tornado-%{tornado_version}.tar.gz
+Source42: https://github.com/CtrlZmaster/tornado/archive/v%{tornado_version}/tornado-%{tornado_version}.tar.gz
 Source43: https://github.com/ericvsmith/dataclasses/archive/%{dataclasses_version}/dataclasses-%{dataclasses_version}.tar.gz
 Source44: https://github.com/konradhalas/dacite/archive/v%{dacite_version}/dacite-%{dacite_version}.tar.gz
-Source45: https://github.com/dateutil/dateutil/archive/%{dateutil_version}/python-dateutil-%{dateutil_version}.tar.gz
+Source45: https://pypi.python.org/packages/source/p/python-dateutil/python-dateutil-%{dateutil_version}.tar.gz
 
 Source81: https://rubygems.org/downloads/backports-%{version_rubygem_backports}.gem
 Source82: https://rubygems.org/downloads/ethon-%{version_rubygem_ethon}.gem
@@ -103,28 +107,20 @@ Source89: https://rubygems.org/downloads/rack-protection-%{version_rubygem_rack_
 Source90: https://rubygems.org/downloads/rack-test-%{version_rubygem_rack_test}.gem
 Source91: https://rubygems.org/downloads/sinatra-%{version_rubygem_sinatra}.gem
 Source92: https://rubygems.org/downloads/tilt-%{version_rubygem_tilt}.gem
-Source93: https://rubygems.org/downloads/eventmachine-%{version_rubygem_eventmachine}.gem
+Source93: https://rubygems.org/downloads/nio4r-%{version_rubygem_nio4r}.gem
-Source94: https://rubygems.org/downloads/daemons-%{version_rubygem_daemons}.gem
+Source94: https://rubygems.org/downloads/puma-%{version_rubygem_puma}.gem
-Source95: https://rubygems.org/downloads/thin-%{version_rubygem_thin}.gem
+Source95: https://rubygems.org/downloads/ruby2_keywords-%{version_rubygem_ruby2_keywords}.gem
-Source96: https://rubygems.org/downloads/ruby2_keywords-%{version_rubygem_ruby2_keywords}.gem
 
-Source100: https://github.com/idevat/pcs-web-ui/archive/%{ui_commit}/%{ui_src_name}.tar.gz
+# pcs patches: <= 200
-Source101: https://github.com/idevat/pcs-web-ui/releases/download/%{ui_modules_version}/pcs-web-ui-node-modules-%{ui_modules_version}.tar.xz
-
-# Patches from upstream.
-# They should come before downstream patches to avoid unnecessary conflicts.
-# Z-streams are exception here: they can come from upstream but should be
-# applied at the end to keep z-stream changes as straightforward as possible.
 # Patch1: bzNUMBER-01-name.patch
-Patch1: fix-wrong-name-for-library-command.patch
+Patch1: do-not-support-cluster-setup-with-udp-u-transport.patch
-
+Patch2: RHEL-17280-01-disable-new-webui-routes.patch
-# Downstream patches do not come from upstream. They adapt pcs for specific
+Patch3: RHEL-65595-stop-sending-http-headers-to-ruby-part-of-pcsd.patch
-# RHEL needs.
+Patch4: RHEL-90147-support-for-query-limits-in-rack.patch
-Patch101: do-not-support-cluster-setup-with-udp-u-transport.patch
 
 # git for patches
 BuildRequires: git-core
-#printf from coreutils is used in makefile
+# printf from coreutils is used in makefile, head is used in spec
 BuildRequires: coreutils
 # python for pcs
 BuildRequires: platform-python
@@ -153,6 +149,10 @@ BuildRequires: rubygem-test-unit
 BuildRequires: diffstat
 # for post, preun and postun macros
 BuildRequires: systemd
+# pam is used for authentication inside daemon (python ctypes)
+# needed for tier0 tests during build
+BuildRequires: pam
+
 # pcsd fonts and font management tools for creating symlinks to fonts
 BuildRequires: fontconfig
 BuildRequires: liberation-sans-fonts
@@ -161,9 +161,6 @@ BuildRequires: overpass-fonts
 # Red Hat logo for creating symlink of favicon
 BuildRequires: redhat-logos
 
-# for building web ui
-BuildRequires: npm
-
 # cluster stack packages for pkg-config
 BuildRequires: booth
 BuildRequires: corosync-qdevice-devel
@@ -213,20 +210,19 @@ Provides: bundled(dataclasses) = %{dataclasses_version}
 Provides: bundled(dacite) = %{dacite_version}
 Provides: bundled(dateutil) = %{dateutil_version}
 Provides: bundled(backports) = %{version_rubygem_backports}
-Provides: bundled(daemons) = %{version_rubygem_daemons}
 Provides: bundled(ethon) = %{version_rubygem_ethon}
-Provides: bundled(eventmachine) = %{version_rubygem_eventmachine}
 Provides: bundled(ffi) = %{version_rubygem_ffi}
 Provides: bundled(json) = %{version_rubygem_json}
 Provides: bundled(mustermann) = %{version_rubygem_mustermann}
+Provides: bundled(nio4r) = %{version_rubygem_nio4r}
 Provides: bundled(open4) = %{version_rubygem_open4}
+Provides: bundled(puma) = %{version_rubygem_puma}
 Provides: bundled(rack) = %{version_rubygem_rack}
 Provides: bundled(rack_protection) = %{version_rubygem_rack_protection}
 Provides: bundled(rack_test) = %{version_rubygem_rack_test}
 Provides: bundled(rexml) = %{version_rubygem_rexml}
 Provides: bundled(ruby2_keywords) = %{version_rubygem_ruby2_keywords}
 Provides: bundled(sinatra) = %{version_rubygem_sinatra}
-Provides: bundled(thin) = %{version_rubygem_thin}
 Provides: bundled(tilt) = %{version_rubygem_tilt}
 
 # javascript bundled libraries for old web-ui
@@ -244,12 +240,12 @@ easily view, modify and create pacemaker based clusters.
 Group: System Environment/Base
 Summary: Pacemaker cluster SNMP agent
 # https://fedoraproject.org/wiki/Licensing:Main?rd=Licensing#Good_Licenses
-# GPLv2: pcs
+# GPL-2.0-only: pcs
 # BSD-2-Clause: pyagentx
-License: GPLv2 and BSD-2-Clause.
+License: GPL-2.0-only AND BSD-2-Clause
 URL: https://github.com/ClusterLabs/pcs
 
-# tar for unpacking pyagetx source tar ball
+# tar for unpacking pyagentx source tarball
 BuildRequires: tar
 
 Requires: pcs = %{version}-%{release}
@@ -262,8 +258,6 @@ Provides: bundled(pyagentx) = %{pyagentx_version}
 SNMP agent that provides information about pacemaker cluster to the master agent (snmpd)
 
 %prep
-%autosetup -p1 -S git -n %{pcs_source_name}
-
 # -- following is inspired by python-simplejon.el5 --
 # Update timestamps on the files touched by a patch, to avoid non-equal
 # .pyc/.pyo files across the multilib peers within a build
@@ -303,14 +297,25 @@ update_times_patch(){
   update_times ${patch_file_name} `diffstat -p1 -l ${patch_file_name}`
 }
 
+# documentation for setup/autosetup/autopatch:
+#   * http://ftp.rpm.org/max-rpm/s1-rpm-inside-macros.html
+#   * https://rpm-software-management.github.io/rpm/manual/autosetup.html
+# patch pcs sources
+%autosetup -S git -n %{pcs_source_name} -N
+%autopatch -p1 -M 200
+# update_times_patch %%{PATCH1}
 update_times_patch %{PATCH1}
-update_times_patch %{PATCH101}
+update_times_patch %{PATCH2}
+update_times_patch %{PATCH3}
+update_times_patch %{PATCH4}
+
+# generate .tarball-version if building from an untagged commit, not a released version
+# autogen uses git-version-gen which uses .tarball-version for generating version number
+%if "%{version}" != "%{version_or_commit}"
+  echo "%version+$(echo "%{version_or_commit}" | head -c 8)" > %{_builddir}/%{pcs_source_name}/.tarball-version
+%endif
 
 cp -f %SOURCE1 %{pcsd_public_dir}/images
-# prepare dirs/files necessary for building web ui
-# inside SOURCE100 is only directory %%{ui_src_name}
-tar -xzf %SOURCE100 -C %{pcsd_public_dir}
-tar -xf %SOURCE101 -C %{pcsd_public_dir}/%{ui_src_name}
 
 # prepare dirs/files necessary for building all bundles
 # -----------------------------------------------------
@@ -334,7 +339,6 @@ cp -f %SOURCE92 %{rubygem_cache_dir}
 cp -f %SOURCE93 %{rubygem_cache_dir}
 cp -f %SOURCE94 %{rubygem_cache_dir}
 cp -f %SOURCE95 %{rubygem_cache_dir}
-cp -f %SOURCE96 %{rubygem_cache_dir}
 
 
 # 2) prepare python bundles
@@ -349,7 +353,10 @@ cp -f %SOURCE45 rpm/
 %define debug_package %{nil}
 
 ./autogen.sh
-%{configure} --enable-local-build --enable-use-local-cache-only PYTHON=%{__python3}
+%{configure} --enable-local-build --enable-use-local-cache-only \
+  --enable-individual-bundling \
+  --enable-booth-enable-authfile-set --enable-booth-enable-authfile-unset \
+  PYTHON=%{__python3} ruby_CFLAGS="%{optflags}" ruby_LIBS="%{build_ldflags}"
 make all
 
 %install
@@ -358,27 +365,27 @@ pwd
 
 %make_install
 
-# build web ui and put it to pcsd
+# RHEL-7715 - fix rubygem permissions - remove write access for owner's group
-make -C %{pcsd_public_dir}/%{ui_src_name} build
+# and other users
-mv %{pcsd_public_dir}/%{ui_src_name}/build  ${RPM_BUILD_ROOT}%{_libdir}/%{pcsd_public_dir}/ui
+chmod --recursive g-w,o-w ${RPM_BUILD_ROOT}%{_libdir}/%{rubygem_bundle_dir}
-rm -r %{pcsd_public_dir}/%{ui_src_name}
 
 # prepare license files
-# some rubygems do not have a license file (ruby2_keywords, thin)
+# some rubygems do not have a license file (thin)
 mv %{rubygem_bundle_dir}/gems/backports-%{version_rubygem_backports}/LICENSE.txt backports_LICENSE.txt
-mv %{rubygem_bundle_dir}/gems/daemons-%{version_rubygem_daemons}/LICENSE daemons_LICENSE
 mv %{rubygem_bundle_dir}/gems/ethon-%{version_rubygem_ethon}/LICENSE ethon_LICENSE
-mv %{rubygem_bundle_dir}/gems/eventmachine-%{version_rubygem_eventmachine}/LICENSE eventmachine_LICENSE
-mv %{rubygem_bundle_dir}/gems/eventmachine-%{version_rubygem_eventmachine}/GNU eventmachine_GNU
 mv %{rubygem_bundle_dir}/gems/ffi-%{version_rubygem_ffi}/COPYING ffi_COPYING
 mv %{rubygem_bundle_dir}/gems/ffi-%{version_rubygem_ffi}/LICENSE ffi_LICENSE
 mv %{rubygem_bundle_dir}/gems/ffi-%{version_rubygem_ffi}/LICENSE.SPECS ffi_LICENSE.SPECS
 mv %{rubygem_bundle_dir}/gems/json-%{version_rubygem_json}/LICENSE json_LICENSE
 mv %{rubygem_bundle_dir}/gems/mustermann-%{version_rubygem_mustermann}/LICENSE mustermann_LICENSE
+mv %{rubygem_bundle_dir}/gems/nio4r-%{version_rubygem_nio4r}/license.md nio4r_license.md
+mv %{rubygem_bundle_dir}/gems/nio4r-%{version_rubygem_nio4r}/ext/libev/LICENSE nio4r_libev_LICENSE
 mv %{rubygem_bundle_dir}/gems/open4-%{version_rubygem_open4}/LICENSE open4_LICENSE
+mv %{rubygem_bundle_dir}/gems/puma-%{version_rubygem_puma}/LICENSE puma_LICENSE
 mv %{rubygem_bundle_dir}/gems/rack-%{version_rubygem_rack}/MIT-LICENSE rack_MIT-LICENSE
 mv %{rubygem_bundle_dir}/gems/rack-protection-%{version_rubygem_rack_protection}/License rack-protection_License
 mv %{rubygem_bundle_dir}/gems/rack-test-%{version_rubygem_rack_test}/MIT-LICENSE.txt rack-test_MIT-LICENSE.txt
+mv %{rubygem_bundle_dir}/gems/ruby2_keywords-%{version_rubygem_ruby2_keywords}/LICENSE ruby2_keywords_LICENSE
 mv %{rubygem_bundle_dir}/gems/sinatra-%{version_rubygem_sinatra}/LICENSE sinatra_LICENSE
 mv %{rubygem_bundle_dir}/gems/tilt-%{version_rubygem_tilt}/COPYING tilt_COPYING
 
@@ -415,22 +422,12 @@ rm -rf $RPM_BUILD_ROOT/usr/lib/debug
 rm -rf $RPM_BUILD_ROOT%{_prefix}/src/debug
 
 # We can remove files required for gem compilation
-rm -rf $RPM_BUILD_ROOT%{_libdir}/%{rubygem_bundle_dir}/gems/eventmachine-%{version_rubygem_eventmachine}/ext
 rm -rf $RPM_BUILD_ROOT%{_libdir}/%{rubygem_bundle_dir}/gems/ffi-%{version_rubygem_ffi}/ext
 rm -rf $RPM_BUILD_ROOT%{_libdir}/%{rubygem_bundle_dir}/gems/json-%{version_rubygem_json}/ext
-rm -rf $RPM_BUILD_ROOT%{_libdir}/%{rubygem_bundle_dir}/gems/thin-%{version_rubygem_thin}/ext
+rm -rf $RPM_BUILD_ROOT%{_libdir}/%{rubygem_bundle_dir}/gems/nio4r-%{version_rubygem_nio4r}/ext
+rm -rf $RPM_BUILD_ROOT%{_libdir}/%{rubygem_bundle_dir}/gems/puma-%{version_rubygem_puma}/ext
 
 %check
-# In the building environment LC_CTYPE is set to C which causes tests to fail
-# due to python prints a warning about it to stderr. The following environment
-# variable disables the warning.
-# On the live system either UTF8 locale is set or the warning is emmited
-# which breaks pcs. That is the correct behavior since with wrong locales it
-# would be probably broken anyway.
-# The main concern here is to make the tests pass.
-# See https://fedoraproject.org/wiki/Changes/python3_c.utf-8_locale for details.
-export PYTHONCOERCECLOCALE=0
-
 run_all_tests(){
   #run pcs tests
 
@@ -442,7 +439,6 @@ run_all_tests(){
   #   TODO: Investigate the issue
 
     %{__python3} pcs_test/suite --tier0 -v --vanilla --all-but \
-    pcs_test.tier0.lib.commands.test_resource_agent.DescribeAgentUtf8.test_describe \
     pcs_test.tier0.daemon.app.test_app_remote.SyncConfigMutualExclusive.test_get_not_locked \
     pcs_test.tier0.daemon.app.test_app_remote.SyncConfigMutualExclusive.test_post_not_locked \
 
@@ -470,7 +466,7 @@ run_all_tests
 remove_all_tests
 
 %posttrans
-# Make sure the new version of the daemon is runnning.
+# Make sure the new version of the daemon is running.
 # Also, make sure to start pcsd-ruby if it hasn't been started or even
 # installed before. This is done by restarting pcsd.service.
 %{_bindir}/systemctl daemon-reload
@@ -512,19 +508,20 @@ remove_all_tests
 %license COPYING
 # rugygem licenses
 %license backports_LICENSE.txt
-%license daemons_LICENSE
 %license ethon_LICENSE
-%license eventmachine_LICENSE
-%license eventmachine_GNU
 %license ffi_COPYING
 %license ffi_LICENSE
 %license ffi_LICENSE.SPECS
 %license json_LICENSE
 %license mustermann_LICENSE
+%license nio4r_license.md
+%license nio4r_libev_LICENSE
 %license open4_LICENSE
+%license puma_LICENSE
 %license rack_MIT-LICENSE
 %license rack-protection_License
 %license rack-test_MIT-LICENSE.txt
+%license ruby2_keywords_LICENSE
 %license sinatra_LICENSE
 %license tilt_COPYING
 %{python3_sitelib}/*
@@ -567,6 +564,197 @@ remove_all_tests
 %license pyagentx_LICENSE.txt
 
 %changelog
+* Mon Jun 23 2025 Michal Pospisil <mpospisi@redhat.com> - 0.10.18-2%{?dist}.6
+- Fixed CVE-2024-49761 by updating rubygem rexml
+  Resolves: RHEL-98708
+
+* Thu May 22 2025 Michal Pospisil <mpospisi@redhat.com> - 0.10.18-2%{?dist}.5
+- Fixed CVE-2024-47287 by patching bundled Tornado
+  Resolves: RHEL-93167
+- Fixed CVE-2025-46727 by updating bundled rubygem rack
+  Resolves: RHEL-90147
+
+* Tue Mar 4 2025 Michal Pospisil <mpospisi@redhat.com> - 0.10.18-2%{?dist}.4
+- Fixed CVE-2024-52804 by patching bundled Tornado
+  Resolves: RHEL-81924
+
+* Wed Dec 4 2024 Michal Pospisil <mpospisi@redhat.com> - 0.10.18-2.el8_10.3
+- Prevented any future HTTP header-based attacks on puma/sinatra by removing any headers not recognized by pcsd
+  Resolves: RHEL-65595
+
+* Thu Aug 29 2024 Michal Pospisil <mpospisi@redhat.com> - 0.10.18-2.el8_10.2
+- Updated rubygem rexml
+  Resolves: RHEL-52409, RHEL-52788, RHEL-55997
+
+* Wed Mar 20 2024 Michal Pospisil <mpospisi@redhat.com> - 0.10.18-2
+- Updated rubygem rexml
+  Resolves: RHEL-37883
+
+* Wed Mar 20 2024 Michal Pospisil <mpospisi@redhat.com> - 0.10.18-2
+- Fixed CVE-2024-25126, CVE-2024-26141, CVE-2024-26146 in bundled dependency rack
+  Resolves: RHEL-26445, RHEL-26447, RHEL-26449
+
+* Mon Jan 8 2024 Michal Pospisil <mpospisi@redhat.com> - 0.10.18-1
+- Rebased to the latest sources (see CHANGELOG.md)
+  Resolves: RHEL-7741
+
+* Fri Dec 8 2023 Michal Pospisil <mpospisi@redhat.com> - 0.10.17-6
+- Rebased to the latest upstream sources (see CHANGELOG.md)
+- Remove the preview of the new pcs web interface
+  Resolves: RHEL-17280
+
+* Tue Nov 14 2023 Michal Pospisil <mpospisi@redhat.com> - 0.10.17-5
+- Rebased to the latest upstream sources (see CHANGELOG.md)
+  Resolves: RHEL-7584, RHEL-7668, RHEL-7729, RHEL-7731, RHEL-7732, RHEL-7741, RHEL-7742, RHEL-7743, RHEL-7745, RHEL-8467
+- Tightened permissions of bundled rubygems to be 755 or stricter
+  Resolves: RHEL-7715
+
+* Mon Nov 6 2023 Michal Pospisil <mpospisi@redhat.com> - 0.10.17-4
+- No changes, fixed an error in the new quality control process
+- Resolves: RHEL-15218
+
+* Wed Nov 1 2023 Michal Pospisil <mpospisi@redhat.com> - 0.10.17-3
+- No changes, testing a new quality control process
+- Resolves: RHEL-15218
+
+* Thu Jul 13 2023 Michal Pospisil <mpospisi@redhat.com> - 0.10.17-2
+- Make use of filters when extracting tarballs to enhance security if provided by Python (`pcs config restore` command)
+- Do not display duplicate records in commands `pcs property [config] --all` and `pcs property describe`
+- Resolves: rhbz#2218841 rhbz#2219388
+
+* Mon Jun 19 2023 Michal Pospisil <mpospisi@redhat.com> - 0.10.17-1
+- Rebased to the latest upstream sources (see CHANGELOG.md)
+- Updated bundled rubygems: tilt, puma
+- Resolves: rhbz#2112259 rhbz#2163439 rhbz#2166289
+
+* Thu May 25 2023 Michal Pospisil <mpospisi@redhat.com> - 0.10.16-1
+- Rebased to the latest upstream sources (see CHANGELOG.md)
+- Updated bundled dependencies: dacite
+- Added bundled rubygems: nio4r, puma
+- Removed bundled rubygems: daemons, eventmachine, thin
+- Updated bundled rubygems: backports, rack, rack-test, tilt
+- Resolves: rhbz#1957591 rhbz#2022748 rhbz#2160555 rhbz#2163439 rhbz#2166289 rhbz#2166294 rhbz#2176490 rhbz#2178700 rhbz#2178707 rhbz#2179010 rhbz#2180378 rhbz#2189958
+
+* Thu Feb 9 2023 Michal Pospisil <mpospisi@redhat.com> - 0.10.15-4
+- Fixed enabling/disabling sbd when cluster is not running
+- Added BuildRequires: pam - needed for tier0 tests during build
+- Resolves: rhbz#2166243
+
+* Mon Jan 16 2023 Michal Pospisil <mpospisi@redhat.com> - 0.10.15-3
+- Allow time values in stonith-watchdog-time property
+- Resource/stonith agent self-validation of instance attributes is now disabled by default, as many agents do not work with it properly
+- Updated bundled rubygems: rack, rack-protection, sinatra
+- Added license for ruby2_keywords
+- Resolves: rhbz#2158804 rhbz#2159455
+
+* Fri Dec 16 2022 Michal Pospisil <mpospisi@redhat.com> - 0.10.15-2
+- Added warning when omitting validation of misconfigured resource
+- Fixed displaying of bool and integer values in `pcs resource config` command
+- Updated bundled rubygems: ethon, json, rack-protection, sinatra
+- Resolves: rhbz#2151166 rhbz#2151511
+
+* Wed Nov 23 2022 Michal Pospisil <mpospisi@redhat.com> - 0.10.15-1
+- Rebased to latest upstream sources (see CHANGELOG.md)
+- Updated Python bundled dependency dateutil
+- Resolves: rhbz#2112002 rhbz#2112263 rhbz#2112291 rhbz#2132582
+
+* Tue Oct 25 2022 Miroslav Lisik <mlisik@redhat.com> - 0.10.14-6
+- Rebased to latest upstream sources (see CHANGELOG.md)
+- Updated rubygem bundled packages: mustermann, rack, rack-protection, rack-test, sinatra, tilt
+- Resolves: rhbz#1816852 rhbz#1918527 rhbz#2112267 rhbz#2112291
+
+* Wed Aug 17 2022 Miroslav Lisik <mlisik@redhat.com> - 0.10.14-4
+- Fixed enable sbd from webui
+- Resolves: rhbz#2117650
+
+* Mon Aug 08 2022 Miroslav Lisik <mlisik@redhat.com> - 0.10.14-3
+- Fixed `pcs quorum device remove`
+- Resolves: rhbz#2115326
+
+* Thu Jul 28 2022 Miroslav Lisik <mlisik@redhat.com> - 0.10.14-2
+- Fixed booth ticket mode value case insensitive
+- Fixed booth sync check whether /etc/booth exists
+- Resolves: rhbz#1786964 rhbz#1791670
+
+* Fri Jun 24 2022 Miroslav Lisik <mlisik@redhat.com> - 0.10.14-1
+- Rebased to latest upstream sources (see CHANGELOG.md)
+- Updated bundled rubygems: rack
+- Resolves: rhbz#2059500 rhbz#2096787 rhbz#2097383 rhbz#2097391 rhbz#2097392 rhbz#2097393
+
+* Tue May 24 2022 Miroslav Lisik <mlisik@redhat.com> - 0.10.13-1
+- Rebased to latest upstream sources (see CHANGELOG.md)
+- Updated pcs-web-ui
+- Updated bundled rubygems: backports, daemons, ethon ffi, json, ruby2_keywords, thin
+- Resolves: rhbz#1730232 rhbz#1786964 rhbz#1791661 rhbz#1791670 rhbz#1874624 rhbz#1909904 rhbz#1950551 rhbz#1954099 rhbz#2019894 rhbz#2023845 rhbz#2059500 rhbz#2064805 rhbz#2068456
+
+* Thu May 05 2022 Miroslav Lisik <mlisik@redhat.com> - 0.10.12-7
+- Updated bundled rubygems: sinatra, rack-protection
+- Resolves: rhbz#2081332
+
+* Fri Feb 11 2022 Miroslav Lisik <mlisik@redhat.com> - 0.10.12-6
+- Fixed processing agents not conforming to OCF schema
+- Resolves: rhbz#2050274
+
+* Tue Feb 01 2022 Miroslav Lisik <mlisik@redhat.com> - 0.10.12-5
+- Fixed snmp client
+- Resolves: rhbz#2047983
+
+* Tue Jan 25 2022 Miroslav Lisik <mlisik@redhat.com> - 0.10.12-4
+- Fixed cluster destroy in web ui
+- Fixed covscan issue in web ui
+- Resolves: rhbz#1970508
+
+* Fri Jan 14 2022 Miroslav Lisik <mlisik@redhat.com> - 0.10.12-3
+- Fixed 'pcs resource move --autodelete' command
+- Fixed removing of unavailable fence-scsi storage device
+- Fixed ocf validation of ocf linbit drdb agent
+- Fixed creating empty cib
+- Updated pcs-web-ui
+- Resolves: rhbz#1990784 rhbz#2022463 rhbz#2032997 rhbz#2036633
+
+* Wed Dec 15 2021 Miroslav Lisik <mlisik@redhat.com> - 0.10.12-2
+- Fixed rsc update cmd when unable to get agent metadata
+- Fixed enabling corosync-qdevice
+- Resolves: rhbz#1384485 rhbz#2028902
+
+* Thu Dec 02 2021 Miroslav Lisik <mlisik@redhat.com> - 0.10.12-1
+- Rebased to latest upstream sources (see CHANGELOG.md)
+- Updated pcs-web-ui
+- Resolves: rhbz#1552470 rhbz#1997011 rhbz#2017311 rhbz#2017312 rhbz#2024543 rhbz#2012128
+
+* Mon Nov 22 2021 Miroslav Lisik <mlisik@redhat.com> - 0.10.11-2
+- Rebased to latest upstream sources (see CHANGELOG.md)
+- Removed 'export PYTHONCOERCECLOCALE=0'
+- Resolves: rhbz#1384485 rhbz#1936833 rhbz#1968088 rhbz#1990784 rhbz#2012128
+
+* Mon Nov 01 2021 Miroslav Lisik <mlisik@redhat.com> - 0.10.11-1
+- Rebased to latest upstream sources (see CHANGELOG.md)
+- Updated pcs-web-ui
+- Enabled wui patching
+- Resolves: rhbz#1533090 rhbz#1970508 rhbz#1997011 rhbz#2003066 rhbz#2003068 rhbz#2012128
+
+* Fri Aug 27 2021 Miroslav Lisik <mlisik@redhat.com> - 0.10.10-2
+- Fixed create resources with depth operation attribute
+- Resolves: rhbz#1998454
+
+* Thu Aug 19 2021 Ondrej Mular <omular@redhat.com> - 0.10.10-1
+- Rebased to latest upstream sources (see CHANGELOG.md)
+- Updated pcs-web-ui
+- Resolves: rhbz#1885293 rhbz#1847102 rhbz#1935594
+
+* Tue Aug 10 2021 Miroslav Lisik <mlisik@redhat.com> - 0.10.9-1
+- Rebased to latest upstream sources (see CHANGELOG.md)
+- Resolves: rhbz#1432097 rhbz#1847102 rhbz#1935594 rhbz#1984901
+
+* Tue Jul 20 2021 Miroslav Lisik <mlisik@redhat.com> - 0.10.8-4
+- Rebased to latest upstream sources (see CHANGELOG.md)
+- Resolves: rhbz#1759995 rhbz#1872378 rhbz#1935594
+
+* Thu Jul 08 2021 Miroslav Lisik <mlisik@redhat.com> - 0.10.8-3
+- Rebased to latest upstream sources (see CHANGELOG.md)
+- Gating changes
+- Resolves: rhbz#1678273 rhbz#1690419 rhbz#1750240 rhbz#1759995 rhbz#1872378 rhbz#1909901 rhbz#1935594
+
 * Thu Jun 10 2021 Miroslav Lisik <mlisik@redhat.com> - 0.10.8-2
 - Rebased to latest upstream sources (see CHANGELOG.md)
 - Updated pcs-web-ui